Common JWT authorization pitfalls include storing sensitive data in the payload, using weak algorithms (none algorithm), not validating audience (aud) and issuer (iss), and overly long token lifetimes.
Information leakage: Payload is base64url-encoded, not encrypted. Never store passwords, credit cards, or other secrets.
Algorithm confusion: Misconfigured servers accepting 'none' algorithm or HS256 when expecting RS256 can lead to token forgery.
Missing validation: Always check aud, iss, exp, nbf, and jti claims. Failure to validate opens the door to replay attacks.
Long expiration: Tokens with long lifetimes (e.g., 30 days) increase damage window if stolen. Use short-lived tokens (5-15 min) with refresh.
Not revoking on logout: Without revocation mechanism, logged-out users can still use their old token until expiry.
0-2 years experience
8+ years experience
