JWT Testing
JWT testing verifies that JSON Web Tokens — the compact, signed tokens widely used for API authentication — are correctly issued, validated, and rejected when tampered with, expired, or signed with the wrong key. A flawed JWT implementation is a direct path to full authentication bypass.
Common JWT vulnerabilities that testing specifically targets: accepting tokens with the algorithm set to "none" (bypassing signature verification entirely), accepting a token signed with a different key than expected, failing to check expiration, and trusting claims inside the token (like a user role) without re-verifying them server-side on every request.
Because a JWT's payload is only base64-encoded, not encrypted, testers can easily decode and manually tamper with claims (changing a role from "user" to "admin") to confirm the server actually validates the signature and rejects the tampered token, rather than blindly trusting whatever the decoded payload happens to say.
