Security
JWT pitfalls: break and harden an auth flow
Reading about JWT attacks is not the same as landing one. Build a small auth flow, forge tokens against it — alg:none, RS256-to-HS256 confusion, a missing aud check, an attacker kid — then apply the unit’s defenses and prove with a failing exploit that each hole is closed.
Turn the unit’s mental model into a reproducible security loop: build a verifier, attack it the way a pentester would, harden it by pinning the algorithm and validating claims, and verify each fix with an exploit that now fails.
Build a JWT-protected API with login, an authenticated /admin route, and refresh, then run an attack suite (alg:none, algorithm confusion, missing aud, attacker kid) — first proving each exploit succeeds against the naive version, then proving it fails after hardening.
- A before/after table for the four exploits: each one reaches /admin (or refresh) against the naive verifier and is rejected with a clear error against the hardened verifier — shown by actual request/response output, not described.
- The hardened verifier rejects a wrong-aud token even when its signature is valid, and rejects an attacker-kid token without ever fetching from the header-named URL.
- Replaying a rotated refresh token triggers family revocation: the legitimate session's next refresh also fails, proving reuse detection fired (demonstrated against the running service).
- A one-paragraph write-up mapping each defense (algorithm pin, key binding, claim checks, kid allowlist, rotation, storage) to the specific exploit it closes and the RFC 8725 guidance behind it.
- Add a revocation list (or short-lived deny-cache keyed on jti) so a confirmed-compromised access token can be killed before exp, and measure the per-request overhead it adds.
- Add a brute-force demo: configure an HS256 path with a weak human-chosen secret, crack it offline from a captured token, then show a 256-bit CSPRNG secret makes the same attack infeasible.
- Wire CSRF defenses for the cookie-stored refresh token (SameSite plus a CSRF token on the refresh endpoint) and prove a cross-site refresh request is rejected.
- Run the attack suite in CI as a security regression gate: the build fails if any forged token ever reaches a protected route.
This is the loop you will run on every real auth review: build the flow, attack it the way an adversary would, then harden by never trusting the token to describe its own verification — pin the algorithm, bind and allowlist keys, validate exp/nbf/iss/aud, resolve kid server-side, and contain leaks with short TTLs, refresh rotation, and XSS-aware storage. Landing each exploit once and watching it fail after the fix turns RFC 8725 from a checklist into instinct.