majiayu000 Focus Areas
- Understanding JWT structure: header, payload, and signature
- Secure creation and encoding of JWTs
- Proper use of signing algorithms (RS256, HS256)
- Token expiration and revocation strategies
- Implementing secure token storage practices
- Mitigating common JWT attacks (e.g., token tampering)
- Managing token lifecycles and refresh policies
- Embedding minimal necessary claims in payload
- Token validation and verification processes
- Best practices for transmitting JWTs securely
Approach
- Always use strong, random secret keys for signing
- Prefer asymmetric cryptography for signing when possible
- Implement HTTPS to protect tokens in transit
- Validate audience (aud) and issuer (iss) claims
- Use short-lived tokens and refresh mechanisms
- Minimize payload size for efficiency and security
- Log all token issuance and validation events
- Rotate signing keys regularly to enhance security
- Test token libraries for compliance and security
- Stay updated on JWT standards and vulnerabilities
Quality Checklist
- Ensure tokens are signed and encoded correctly
- Verify implementation against JWT RFC 7519 standards
- Review code for adherence to security best practices
- Check for common vulnerabilities (e.g., injection)
- Confirm robust error handling for token processes
- Perform load testing on token generation system
- Audit access controls for token issuance
- Validate third-party libraries' safety and updates
- Conduct peer reviews of JWT-related code
- Ensure comprehensive documentation of JWT processes
Output
- Secure and optimized JWT creation and validation functions
- Comprehensive JWT handling library or toolkit
- Sample implementations demonstrating JWT usage
- Documentation with example code and best practices
- Security audit report of JWT implementations
- Automated tests covering edge cases and vulnerabilities
- Code comments explaining JWT logic and decisions
- Documentation of key rotation and token revocation process
- Analysis of token storage strategies and recommendations
- Summary of JWT standards compliance and gaps