JWT Authentication in Production: Signature Verification, Storage & Revocation
Common JSON Web Token vulnerabilities including algorithm confusion, weak secrets, and insecure localStorage token storage. How to architect secure JWT sessions.
1. The Pitfalls of Stateless Tokens
JSON Web Tokens (JWT) are widely adopted for microservices and decoupled authentication because they allow stateless verification without querying a session database on every incoming request.
However, statelessness introduces severe architectural challenges: once issued, a standard JWT cannot be revoked before its expiration time unless a revocation blocklist or database session tracking layer is maintained.
2. The Dangerous 'Algorithm Confusion' Vulnerability
Early JWT libraries were notorious for accepting tokens with `alg: 'none'`, causing verification routines to accept forged signatures as valid admin credentials.
A related attack involves tricking an asymmetric verification routine (RS256) into verifying a token using symmetric HMAC (HS256) signed with the public server key. Defend against this by hardcoding expected algorithms explicitly in your verification routine.
import * as jose from "jose";
export async function verifyAuthToken(token: string, secretKey: string) {
try {
const secret = new TextEncoder().encode(secretKey);
const { payload } = await jose.jwtVerify(token, secret, {
algorithms: ["HS256"], // Strictly enforce HS256 to block alg confusion
clockTolerance: 15, // 15 seconds clock skew protection
});
return { valid: true, payload };
} catch (err) {
return { valid: false, error: "Invalid or expired token" };
}
}3. Storage: Cookies vs. LocalStorage
Storing JWTs in browser `localStorage` leaves tokens completely vulnerable to Cross-Site Scripting (XSS). Any third-party script or injected dependency can read `localStorage.getItem('token')` and exfiltrate user credentials to a remote server.
Always store session tokens in `HttpOnly`, `Secure`, `SameSite=Lax` cookies. This prevents JavaScript from reading the cookie value while ensuring browsers transmit it automatically on authenticated requests.