JWT Security

ELI5 — The Vibe Check

JWT Security is about not screwing up JSON Web Tokens. Common mistakes: not validating the signature, accepting 'alg: none', storing sensitive data in the payload (it's base64, not encrypted!), and never expiring tokens. JWTs are easy to use and easy to misuse.

Real Talk

JWT security best practices include: always validate signatures, reject 'none' algorithm, use asymmetric algorithms (RS256/ES256) for distributed verification, set short expiration times, don't store sensitive data in payloads, validate issuer and audience claims, and implement token revocation strategies.

Show Me The Code

const payload = jwt.verify(token, publicKey, {
  algorithms: ['ES256'],
  issuer: 'auth.example.com',
  audience: 'api.example.com',
  clockTolerance: 30
});

When You'll Hear This

"Always whitelist algorithms in JWT verification — never let the token tell you which algorithm to use." / "Our JWTs expire in 15 minutes with refresh token rotation."