DevConf.US 2022

JSON Web Tokens (JWTs) became widely used in authentication processes to transfer information in a JSON format while ensuring data integrity. However merely using a JWT is not enough to ensure your information is handled in a secure way. As a result of JWT's simplicity, it is easy to change the configuration or misuse the data that is sent, thus creating a potentially vulnerable application while thinking it is totally secure.
This talk will explain what JWTs are and how to avoid common security mistakes when using them. We will discuss proper token validation, settings that disable the JWT signature and should be avoided, and what information should not be sent when creating JWTs.