Agent WranglersAccess and accounts Required
Verify every token
Check the signature, algorithm, expiry and audience of every signed token, such as a JWT. Keep tokens short-lived.
How to do it
Use a maintained library and pin the algorithms you accept. Never let the token's own header pick the algorithm or fetch a key, such as alg, jku or x5u. Use kid only to pick from your own list of keys. Keep the signing key secret and long. Give access tokens a life of minutes, and use a refresh token that the server can revoke.
How to check
Send a token with its signature removed and another with alg set to none. Send an expired one and one signed with a guessed key such as secret. Every request returns 401.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts/token-checks.