Testing JSON Web Tokens (JWTs) for Security Flaws: A Detailed Methodology for Testers

In this post you’ll find different methodologies and every important area to test for JWT vulnerabilities (header attacks, alg confusion, kid/jku/jwk injections, claim tampering, storage/transport issues, and more) so you can reproduce, document, and...