JWT Seguridad Referencia
Seguridad-focused referencia para JSON Web Tokens: algoritmos, validation, y común pitfalls.
Algorithm Security
HS256 (HMAC-SHA256) uses a shared secret; compromise of the secret forges any token. RS256/ES256 use asymmetric keys; the private key signs, public key verifies. The none algorithm must always be rejected; libraries historically had bypass bugs. Key confusion attacks exploit RS256 tokens verified with the public key as an HMAC secret. Use algorithm allowlists, never accept alg from the token header alone. ES256K (secp256k1) is used in Ethereum.
- HS256
- Shared secret
- RS256
- Asymmetric
- none
- Must reject
secret compromise = forgeprivate signs, public verifieshistorical bypassValidation Pitfalls
Always validate signature, exp (expiry), iat (issued at), iss (issuer), and aud (audience). Reject expired tokens; clock skew tolerance should be minimal. Verify the token type (JWT) and content type. Do not store sensitive data in JWT payload (it is base64, not encrypted). Use short-lived access tokens with refresh tokens for long sessions. Rotate signing keys (kid header) for key compromise response. Bind tokens to sessions or fingerprints to prevent replay.
- validate all
- exp, iat, iss, aud
- no secrets
- Payload is readable
- kid
- Key rotation
not just signaturebase64 not encryptionkey ID header