domains / families / security / testing-jwt-token-security

testing-jwt-token-security

separate

Assessing JSON Web Token implementations for cryptographic weaknesses,

When to use

• During authorized penetration tests when the application uses JWT for authentication or authorization
• When assessing API security where JWTs are passed as Bearer tokens or in cookies
• For evaluating SSO implementations that use JWT/JWS/JWE tokens
• When testing OAuth 2.0 or OpenID Connect flows that issue JWTs
• During security audits of microservice architectures using JWT for inter-service authentication

Skill page

Source