jwt-security

What problem does it solve?

Identify and remediate JWT security vulnerabilities in modern web applications.

Core Features & Use Cases

• Demonstrates weaknesses in JWT handling including weak/none algorithms, algorithm confusion, token replay, and claim manipulation.
• Provides guidance on secure signing, short-lived tokens, and robust claim validation across typical service architectures (monoliths and microservices).
• Use Case: A backend service validates JWTs from an API gateway and rejects tokens with weak signatures, long expirations, or manipulated claims.

Quick Start

Use the jwt-security skill to analyze a sample token and observe vulnerability scenarios, then implement mitigations like RS256/ES256 signing, short expirations, and JTI checks.