JWT Security Mistakes and How to Avoid Them

JWT is powerful for API auth, but many production incidents come from implementation mistakes, not from JWT itself. If your app uses access tokens, refresh tokens, and role claims, your security depends on the details.

1) Accepting Any Algorithm

Never trust the algorithm sent by the token header alone. Your server must enforce an explicit allow-list (for example, only RS256).

• Pin expected algorithms server-side.
• Reject tokens with missing or unexpected alg.
• Use mature, actively maintained JWT libraries.

2) Long-Lived Access Tokens

If an access token leaks and remains valid for days, an attacker has too much time. Keep access tokens short-lived and rely on refresh flow.

• Access token: short TTL (5-15 minutes).
• Refresh token: longer TTL + rotation + revocation.
• Invalidate sessions on suspicious activity.

3) Leaking Tokens in URLs and Logs

Never put JWTs in query params. URLs end up in logs, analytics, browser history, and referrers.

• Send tokens in Authorization: Bearer ... header.
• Scrub auth headers from logs and APM traces.
• Mask sensitive fields in client error reporting.

4) Weak Claim Validation

Validate iss, aud, exp, nbf, and iat. Also verify business constraints like tenant id and required roles.

• Reject expired or not-yet-valid tokens.
• Bind expected audience per service.
• Do not trust role claims without server-side checks.

5) No Key Rotation Strategy

Keys leak, certificates expire, and incidents happen. Plan rotation before production launch.

• Use kid headers and JWKS endpoints.
• Support overlapping keys during rotation windows.
• Monitor signature-validation failures for anomalies.

Practical Hardening Checklist

1. Enforce strict algorithm allow-list.
2. Use short-lived access tokens.
3. Rotate refresh tokens and support revocation.
4. Store tokens securely (prefer httpOnly cookies).
5. Validate all standard and business-critical claims.
6. Implement key rotation with monitoring.

Related Tools

• JWT Decoder — inspect header and payload safely.
• Hash Generator — verify message and file fingerprints.
• Password Generator — create strong secrets for admin and service accounts.