JSON Web Token (JWT) Weaknesses

Detects insecure JWT implementations, such as accepting 'none' algorithms or using hardcoded secrets.

zakirkun Updated

File contents

JSON Web Token (JWT) Weaknesses

Overview

Detects insecure JWT implementations, such as accepting 'none' algorithms or using hardcoded secrets.

Remediation

Always enforce cryptographic signatures (e.g., HS256, RS256). Do not allow the 'none' algorithm. Always load secrets from environment variables.

zakirkun/ice-tea/tree/main/skills/auth/jwt-weaknesses commit dba21f79bd

Frequently asked questions

npx skillmds@latest add zakirkun/json-web-token-jwt-weaknesses