JWT
JSON Web Token
A compact, usually signed, container of claims. Decoding a JWT does not establish authenticity, intended audience, purpose or current permission; verify the signature and claims first.
- Defined in
- RFC 7519
Covered in
JWT validation: algorithms, keys, claims and key rollover
Validate a JWT against a fixed algorithm, trusted keys and the expected issuer, audience and type, reject the known header attacks, and rotate signing keys without accepting arbitrary keys or breaking valid tokens.
Defend JWTs against forgery, confusion and replay
Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
Case study: Storm-0558 and the forged Microsoft tokens (2023)
How a stolen 2016 consumer signing key and a token validation gap let Storm-0558 read enterprise Exchange Online mail in 2023, and what the review board found about rotation, logging and culture.
SCIM deprovisioning: make account disablement remove every usable authority
Connect SCIM resource updates to current sessions, tokens, group-derived permissions and background jobs, with explicit tenant mapping, CAEP revocation events and a measurable revocation contract.
Practice: JWT validation lab: Validate the purpose and audience of a token · JWT verification lab: Verify a JWT before trusting it · Local project: Secure a real HTTP API · Local project: Verify tokens through rotation and revocation