JWT authorization pitfalls?
Common JWT authorization pitfalls include storing sensitive data in the payload, using weak algorithms (none algorithm), not validating audience (aud) and issuer (iss), and overly long token lifetimes.
- 1
Information leakage: Payload is base64url-encoded, not encrypted. Never store passwords, credit cards, or other secrets.
- 2
Algorithm confusion: Misconfigured servers accepting 'none' algorithm or HS256 when expecting RS256 can lead to token forgery.
- 3
Missing validation: Always check
aud,iss,exp,nbf, andjticlaims. Failure to validate opens the door to replay attacks. - 4
Long expiration: Tokens with long lifetimes (e.g., 30 days) increase damage window if stolen. Use short-lived tokens (5-15 min) with refresh.
- 5
Not revoking on logout: Without revocation mechanism, logged-out users can still use their old token until expiry.