API Hacking: JWT Pitfalls for Testers and Developers

JWTs are convenient and dangerous. They push authentication state into a signed blob the server parses on every request. When parsing is loose, the blob becomes a negotiation table attackers want a seat at.

As a tester you're not trying to break crypto for sport—you're checking whether the app verifies signatures, audience, expiry, and issuer the way it claims.

Validation gaps I see repeatedly

Accepting `none` or unexpected algorithms, skipping signature verification on internal routes, and trusting claims like `role` without mapping them server-side.

Refresh flows sometimes re-issue tokens with broader scopes than the original login intended.

What to inspect during authorized assessments

Capture tokens for each role. Note header and payload fields, lifetimes, and where they're stored—cookie vs localStorage changes XSS impact.

• Check logout and rotation: does the old token still work?

• Compare API vs web issuer settings

• Look for JWKS endpoints with caching quirks

Developer-facing fixes

Use a maintained library, pin algorithms, validate aud/iss/exp, and keep authorization out of the token except as a stable subject identifier. Short lifetimes plus refresh with rotation beat long-lived god tokens.

JWT findings are high impact when you prove policy bypass, not when you decode base64 for fun.

Work only with tokens you're issued on in-scope systems—don't harvest production sessions from real users.

Storage and transport side effects

Where the token lives changes your story: HttpOnly cookies reduce XSS token theft but CSRF may re-enter; localStorage makes XSS worse but CSRF different.

Microservices that only parse JWTs without re-validating issuer create trust islands—document which service actually authorizes the request.

Rotation and revocation

Password reset should invalidate outstanding JWTs when sessions are token-based—verify that story end to end.

Key rotation without invalidating old signatures is a common migration footgun—check JWKS caching TTL in clients.

Document whether service accounts use long-lived JWTs; they belong in a different risk bucket than user sessions.

---

Worth reading next

API Hacking: OAuth and SAML Security Notes

Web Hacking for Pentesters: Cross-Site Scripting (XSS)

API Hacking: GraphQL Authorization Consistency