apply-jwt-security

Use when implementing JWT-based authentication or authorization — covering token generation, algorithm selection, validation, expiry, and revocation for stateless APIs.

Jump to install

Repository: jeffreytse/grimoire-core
Last source activity: July 5, 2026 at 16:53
Detected SKILL.md language: English
Stars: 4
Forks: 1

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/jeffreytse/grimoire-core --skill apply-jwt-security

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

name	apply-jwt-security
description	Use when implementing JWT-based authentication or authorization — covering token generation, algorithm selection, validation, expiry, and revocation for stateless APIs.
source	OWASP JSON Web Token Cheat Sheet (owasp.org/www-project-cheat-sheets); RFC 7519 (JWT); RFC 8725 (JWT Best Current Practices); CWE-347
tags	["security","owasp","jwt","authentication","authorization","api","developer"]

Apply JWT Security

Issue JWTs with explicit algorithm pinning, short expiry, and server-side validation — protecting against algorithm confusion attacks, token forgery, and indefinite token validity.

Why This Is Best Practice

Adopted by: RFC 8725 "JWT Best Current Practices" (IETF, 2020) is the definitive standard. Auth0, Okta, AWS Cognito, and Google Identity Platform all enforce strict JWT validation. OWASP API Security Top 10 2023 (API2:Broken Authentication) cites JWT misuse. PCI DSS v4.0 Requirement 8.6 requires authentication token expiration controls. Impact: The alg:none attack (CVE-2015-9235 in jwt.js) allowed any JWT to be accepted as valid by setting the algorithm to "none" — effectively bypassing all authentication. The RS256/HS256 algorithm confusion attack (exploited at Accenture, SecureWorks, and in CTF competitions) allows attackers to forge tokens using the public key as the HMAC secret. Auth0 paid $1,500–$5,000 bounties for JWT misuse findings. Improper JWT validation is a top finding in API security audits. Why best: Client-side storage of authentication state (JWT) vs. server-side sessions — JWTs eliminate database lookups but require strict validation. The tradeoff: JWTs cannot be revoked without a denylist, so short expiry is mandatory. Opaque session tokens (see ) are better for applications needing instant revocation; JWTs are better for stateless, distributed systems.

import jwt # PyJWT # BAD — accepts whatever alg the token claims payload = jwt.decode(token, key, algorithms=None) # GOOD — pin to one algorithm payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256']) # For RS256 (asymmetric): payload = jwt.decode(token, PUBLIC_KEY, algorithms=['RS256'])

from datetime import datetime, timedelta, timezone import jwt payload = { 'sub': str(user_id), 'iat': datetime.now(timezone.utc), 'exp': datetime.now(timezone.utc) + timedelta(minutes=15), # access token 'jti': str(uuid.uuid4()), # unique token ID for revocation } token = jwt.encode(payload, PRIVATE_KEY, algorithm='RS256')

payload = jwt.decode( token, PUBLIC_KEY, algorithms=['RS256'], options={ 'require': ['exp', 'iss', 'sub'], 'verify_exp': True, 'verify_iss': True, }, issuer='https://auth.example.com', audience='https://api.example.com', )

# Store revoked JTIs in Redis with TTL = token remaining expiry def revoke_token(jti, ttl_seconds): redis.setex(f'revoked:{jti}', ttl_seconds, '1') def is_revoked(jti): return redis.exists(f'revoked:{jti}') # On every request: payload = jwt.decode(token, ...) if is_revoked(payload['jti']): raise AuthError("Token revoked")

apply-jwt-security

Install options

Review the source files

Apply JWT Security

Why This Is Best Practice

Apply JWT Security

Why This Is Best Practice

Steps

Rules

Common Mistakes

apply-jwt-security

Source facts

Install options

Review the source files

More from this repository

More from this repository

Apply JWT Security

Why This Is Best Practice

Apply JWT Security

Why This Is Best Practice

Steps

Rules

Common Mistakes