api-auth-and-jwt-abuse

To test JWT claim tampering and algorithm confusion, inspect header parameters like `alg` and `kid` to validate failure modes such as unsigned `alg:none` acceptance, RS256/HS256 confusion, and untrusted `kid` handling against your target API.

Common rate limit bypass patterns for REST and GraphQL APIs involve abusing proxy-related headers and leveraging GraphQL or JSON batching to multiply attempts within existing constraints.

Untrusted key fetch abuse with JWTs works by exploiting remote key fetch parameters like `jku` and `x5u` in the token header, allowing attackers to point the API to fetch cryptographic keys from an untrusted external source.

Header spoofing can bypass API authentication by injecting forged proxy-related identity headers, exploiting endpoints that mistakenly trust these signals for authorization without properly validating the actual bearer tokens or JWT claims.

When triaging JWTs for API trust flaws, inspect security-sensitive claims including role, org, tenant, scope, and privilege fields to spot issuer or audience misuse and identity reuse problems.

Yes, this approach works for both REST and GraphQL endpoint security testing, systematically identifying token trust weaknesses, header spoofing vulnerabilities, and batch or rate-limit bypass behaviors across both API architectures.