Blog
Long-form posts on JWT security and how to check tokens.
-
JWT claims your auth team forgets to check (and how each one bit me)
iss, aud, jti, nbf, sub. The JWT spec defines these for a reason — but most production code only checks exp and the signature. Here's why each of the others matters.
-
fast-jwt CVE-2026-34950: how leading whitespace re-enabled algorithm confusion
In fast-jwt 6.1.0 and earlier, an RSA public key with leading whitespace was treated as an HMAC secret, reopening CVE-2023-48223. Fixed in 6.2.0. What to do.