JSON Web Token (JWT)
: A compact, URL-safe token format for securely transmitting claims between parties as a JSON object. JWTs consist of three Base64-encoded parts (header, payload, signature) separated by dots. They are commonly used for stateless authentication where the server verifies the token’s signature without storing session state.
Why It Matters for AI-Coded Apps
JWT is the most common authentication mechanism in AI-generated applications. However, LLMs frequently generate insecure JWT implementations: using the none algorithm, hardcoded secrets, tokens that never expire, storing sensitive data in the payload, or failing to validate the signature on the server.
Real-World Example
A JWT payload looks like: {"sub": "user123", "role": "admin", "exp": 1709251200}. The server signs this with a secret key. On each request, the server verifies the signature and reads claims. If the secret is weak (like ‘secret123’), an attacker can forge tokens with any role.
How to Detect and Prevent It
Use strong, randomly generated secrets (256+ bits). Always validate the alg header and reject none. Set short expiration times (15 minutes) with refresh tokens. Never store sensitive data in the payload (it’s Base64-encoded, not encrypted). Use asymmetric keys (RS256) for distributed systems.
Frequently Asked Questions
Should I store JWTs in localStorage or cookies?
Use HttpOnly, Secure, SameSite=Strict cookies. localStorage is accessible to JavaScript, meaning any XSS vulnerability exposes the token. HttpOnly cookies are not accessible to JavaScript and are automatically sent with requests.
What is the difference between JWT and session-based auth?
Session-based auth stores state on the server (session ID maps to user data). JWT stores state in the token itself (stateless). Sessions are easier to revoke but require server-side storage. JWTs scale better but are harder to revoke before expiration.
Is JWT authentication secure?
JWT is secure when implemented correctly: strong secrets, short expiration, proper algorithm validation, HttpOnly cookie storage, and signature verification. Most JWT vulnerabilities come from implementation mistakes, not the standard itself.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval