domains / families / security / phy-jwt-auth-audit

phy-jwt-auth-audit

separate

JWT and OAuth/OIDC security auditor. Decodes any JWT token (without verification) to inspect alg/exp/iss/aud/scope claims, detects the "alg:none" bypass vulnerability, expired or no-expiry tokens, overly broad OAuth scopes, JWT stored in localStorage (XSS theft risk), JWT in URL parameters (log leakage), missing issuer/audience validation in source code, hardcoded tokens in .env files, and weak HMAC secrets. Also scans source files for insecure token handling patterns: Bearer token logged, token compared with ==, auth bypass via role:admin in payload. Generates a severity-ranked report with exact code locations and fixes. Zero external API — pure local analysis. Triggers on "JWT audit", "token security", "auth security", "alg none", "OAuth scopes", "bearer token", "token expiry", "/jwt-audit".

When to use

• Decode JWT tokens without verification
• Inspect alg/exp/iss/aud/scope claims
• Detect alg:none bypass vulnerability
• Detect expired or no-expiry tokens
• Detect overly broad OAuth scopes
• Scan for JWT stored in localStorage
• Scan for JWT in URL parameters
• Scan source files for insecure token handling patterns

When not to use

• External API calls
• Token verification for auth decisions

Skill page

Source