JWTs are just one option for authentication and authorisation, both of which are equally essential to security. Authentication confirms who you are, while authorisation determines what you can access. JWTs often include claims that define a user\u2019s roles, permissions, and access levels, but if these are not properly validated, attackers can modify them to escalate privileges or bypass restrictions altogether.<\/span>\u00a0<\/span><\/p>\n Understanding the risks is the first step to securing JWTs effectively. The next section covers how attackers exploit them, followed by ways to strengthen their security.<\/span><\/p>\n Before diving into exploits, it\u2019s important to understand what JWTs are and how they work. As previously mentioned, JWTs are widely used for authentication and authorisation. They allow systems to verify a user\u2019s identity and access level without requiring session data to be stored on the server. Unlike traditional session tokens, all the necessary data is stored on the client-side within the JWT itself. This makes them a popular choice for highly distributed websites, allowing users to interact seamlessly across multiple back-end servers.<\/span><\/p>\n Figure\u00a0<\/span>1<\/span>\u00a0decoded example of a JWT<\/span><\/em>\u00a0<\/span><\/p>\n A JWT consists of three parts: the\u00a0header,\u00a0payload, and\u00a0signature. These are Base64-encoded and joined together with dots, forming a compact token that looks like this:<\/span><\/p>\n eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkN5YmFWZXJzZSIsImFkbWluIjp0cnVlLCJpYXQiOjE3Mzg2MTEzOTksImV4cCI6MTczODYxNDk5OX0.aS3zuaxqSRln7x1w8yoDZh6ikgxok4iHykNORwNsrVY<\/p>\n Let\u2019s break it down.<\/p>\n The header contains information about how the JWT is signed.<\/span><\/p>\n {<\/span>\u00a0<\/span><\/p>\n \u00a0 “typ”: “JWT”,<\/span>\u00a0<\/span><\/p>\n \u00a0 “alg”: “HS256”<\/span>\u00a0<\/span><\/p>\n }<\/span>\u00a0<\/span><\/p>\n The\u00a0<\/span>alg<\/span><\/i><\/strong>\u00a0field specifies the signing algorithm, such as HS256 (HMAC SHA-256) or RS256 (RSA SHA-256). The<\/span>\u00a0typ<\/span><\/i><\/strong>\u00a0field just indicates this is a JWT.<\/span>\u00a0<\/span><\/p>\n The payload holds the claims, which are details about the user and their permissions.<\/span><\/p>\n {<\/span><\/i>\u00a0<\/span><\/p>\n \u00a0 “sub”: “1234567890”,<\/span><\/i>\u00a0<\/span><\/p>\n \u00a0 “name”: “CybaVerse”,<\/span><\/i>\u00a0<\/span><\/p>\n \u00a0 “admin”: true,<\/span><\/i>\u00a0<\/span><\/p>\n \u00a0 “iat”: 1738611399,<\/span><\/i>\u00a0<\/span><\/p>\n \u00a0 “exp”: 1738614999<\/span><\/i>\u00a0<\/span><\/p>\n }<\/span><\/i>\u00a0<\/span><\/p>\n In this example:<\/span><\/p>\n Claims like\u00a0<\/span>sub<\/span><\/i><\/strong>,\u00a0<\/span><\/i>exp<\/span><\/i><\/strong>,\u00a0<\/span><\/i>and\u00a0<\/span>role<\/span><\/i><\/strong>\u00a0are often used for authorisation, helping systems decide what a user is allowed to do.<\/span>\u00a0<\/span><\/p>\n The signature makes sure the JWT hasn\u2019t been tampered with. If someone tries to change the payload, the signature will no longer match, and the JWT should be rejected.<\/span><\/p>\n Next, we will look at how JWTs can be exploited and what can be done to secure them.<\/span>\u00a0<\/span><\/p>\n Before getting into some of the documented common exploits, the most frequent issue found is authorisation. While this is not a direct flaw of JWTs, it is often a misconfiguration. Many applications have multiple user levels, yet access control is either poorly implemented or inconsistently applied across different areas.<\/span>\u00a0<\/span><\/p>\n Just because an\u00a0<\/span>\/api\/admin\u00a0<\/span><\/i><\/strong>endpoint is not visible on the web application, does not mean attackers won\u2019t find it. Endpoint discovery is straightforward, and without proper access control, critical actions like creating an admin user can often be performed by unauthorised accounts.<\/span>\u00a0<\/span><\/p>\nThey Work and Why They Matter<\/span><\/h4>\n
![\"Figure](\"https:\/\/www.cybaverse.co.uk\/hs-fs\/hubfs\/figure%201.png?width=1395&height=735&name=figure%201.png\")
<\/div>\nHeader<\/h3>\n
Payload<\/h3>\n
\n
\n
\n
\n
Signature<\/h3>\n
Common JWT Security Exploits<\/span><\/h4>\n
![\"Figure](\"https:\/\/www.cybaverse.co.uk\/hs-fs\/hubfs\/figure%202.webp?width=1118&height=331&name=figure%202.webp\")
<\/div>\n