security-review-owasp-json-web-token-for-java

Review Java JWT authentication filters by checking for algorithm confusion, weak secrets, and missing validation. This Skill assesses token creation, verification, and storage to report confirmed weaknesses, review gaps, and passed checks.

Common JWT claim validation gaps include missing issuer, audience, and expiration checks. This Skill reviews token verification logic to identify unvalidated claims and ensure safe client storage across your Java services.

Prevent JWT replay attacks by validating expiration and implementing fail-closed revocation workflows. This Skill reviews logout, refresh, and denylist logic to confirm replay defenses and revocation behavior operate securely.

Yes, this security review checks for JWT algorithm confusion and weak key management. It requires explicit algorithm pinning and strong key handling to prevent signature bypass in Java authentication flows.

Yes, you can use this to audit JWT storage and session replacement flows. It checks for unsafe browser storage and reviews authorization rules across Java code, configuration, architecture, and operational controls.