Implementing JWT Signing And Verification

Implementing JWT Signing and Verification

Overview

JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization in web applications. This skill covers implementing secure JWT signing with HMAC-SHA256, RSA-PSS, and EdDSA algorithms, along with verification, token expiration, claims validation, and defense against common JWT attacks (algorithm confusion, none algorithm, key injection).

When to Use

Trigger phrases:

• "implementing jwt signing and verification"

• "JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for "

• When deploying or configuring implementing jwt signing and verification capabilities in your environment

• When establishing security controls aligned to compliance requirements

• When building or improving security architecture for this domain

• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with cryptography concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Implement JWT signing with HS256, RS256, ES256, and EdDSA
• Verify JWT signatures and validate standard claims
• Implement token expiration, not-before, and audience validation
• Defend against algorithm confusion and none algorithm attacks
• Implement JWT key rotation with JWK Sets
• Build a complete authentication middleware

Key Concepts

This section covers key concepts for implementing jwt signing and verification.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

JWT Algorithms

Common JWT Attacks

• Algorithm confusion: Switching from RS256 to HS256, using public key as HMAC secret
• None algorithm: Setting alg=none to bypass signature verification
• Key injection: Embedding key in JWK header
• Weak secrets: Brute-forcing short HMAC secrets
• Token replay: Reusing valid tokens without expiration

Security Considerations

• Always validate the algorithm header against an allowlist
• Never accept alg=none in production
• Use asymmetric algorithms (RS256, ES256) for distributed systems
• Set short expiration times (15 min for access tokens)
• Implement token refresh mechanism
• Store secrets securely (not in source code)

Validation Criteria

• JWT signing produces valid tokens for all algorithms
• Signature verification rejects tampered tokens
• Expired tokens are rejected
• Algorithm confusion attack is prevented
• None algorithm is rejected
• JWK key rotation works correctly
• Claims validation enforces all required claims

When NOT to Use

• You need to test the implementation (use performing-* skills)
• Task is about configuring existing tools (use configuring-* skills)
• You need to analyze security events (use analyzing-* skills)
• Task is about building detection rules (use building-* skills)
• You don't have access to the target environment
• Task requires vendor-specific expertise (consult vendor docs)

Red Flags

• Performing actions without explicit written authorization from the asset owner
• Testing against production systems without a defined scope and rules of engagement
• Testing without rate limiting, potentially causing service degradation
• Storing sensitive test data (credentials, tokens) in plain text logs
• Using automated scanners blindly without reviewing results for false positives

Verification

• All steps executed successfully against a test environment before production use
• Output documented with screenshots or logs demonstrating expected behavior
• Vulnerabilities reproduced with proof-of-concept and impact analysis
• False positives filtered out through manual verification
• Fix recommendations include code-level remediation guidance

Process

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Analyze the task requirements
2. Apply domain expertise
3. Verify output quality

Anti-Rationalization Table