jwt-misuse-anti-pattern

What problem does it solve?

This Skill addresses critical security vulnerabilities arising from the improper use of JSON Web Tokens (JWTs), preventing authentication bypass, token forgery, and sensitive data exposure in AI-generated code.

Core Features & Use Cases

• Detects Algorithm Confusion: Identifies and helps fix vulnerabilities where JWT libraries accept insecure algorithms like "none".
• Enforces Strong Secrets: Guides users to use robust, securely managed secrets for symmetric signing.
• Prevents Sensitive Data Exposure: Warns against including Personally Identifiable Information (PII) or other sensitive data in JWT payloads.
• Ensures Expiration: Promotes the use of expiration claims (exp) to limit token validity.
• Use Case: When reviewing code that handles user authentication via JWTs, this skill will flag insecure practices like using weak secrets or not specifying algorithms, and provide secure alternatives.

Quick Start

Review the attached code snippet for JWT misuse vulnerabilities.