jwt
Safeguard articles tagged "jwt" — guides, analysis, and best practices for software supply chain and application security.
16 articles
JWT security vulnerabilities and best practices
The jsonwebtoken library shipped three separate signature-bypass CVEs between 2015 and 2022 — algorithm confusion is still the most common way JWTs fail.
API Authentication Best Practices (2026)
How you authenticate API clients decides how bad a leaked credential gets. Here is how to choose and harden API keys, bearer tokens, JWTs, and mTLS in 2026.
Secure JWT handling: algorithm confusion, expiry, and storage done right
A single unchecked `alg` header turned jsonwebtoken into a forgeable token in CVE-2015-9235 — here's how to close every hole RFC 8725 warns about.
JWT Security Vulnerabilities and How to Avoid Them
JSON Web Tokens are only as safe as how you verify them. The alg:none trick, RS256-to-HS256 confusion, and weak secrets have all led to full auth bypass.
JWT (JSON Web Token)
A JWT (JSON Web Token) is a compact, signed token used to prove identity and claims between systems. Here's how they work, and where they break.
PASETO tokens
PASETO tokens explained: what is PASETO, how PASETO vs JWT differs, and why platform-agnostic security tokens with versioned crypto are safer by design.
jose npm: A Security Review and Safe Usage Guide
The jose npm package is a well-regarded library for JWT, JWS, and JWE across JavaScript runtimes. It gives you the right primitives; using them securely still comes down to how you verify tokens.
localStorage Security: Why You Shouldn't Keep Tokens There
localStorage security comes down to one fact: any script on your page can read it. That makes it the wrong place for auth tokens and anything sensitive.
jwks-rsa: Verifying JWTs Against a JWKS Endpoint Safely
The jwks-rsa npm library fetches signing keys from a JWKS endpoint so you can verify JWTs correctly. Here is how to wire it up without introducing key-confusion or availability bugs.
System.IdentityModel.Tokens.Jwt: A Security Guide for .NET JWT Handling
System.IdentityModel.Tokens.Jwt is the standard .NET library for JSON Web Tokens, but a DoS CVE and a few validation defaults decide whether your token handling is actually safe.
nimbus-jose-jwt: JWT Handling in Java Done Right
com.nimbusds:nimbus-jose-jwt is the JVM's workhorse JOSE library. Here is how to configure it so algorithm confusion, weak validation, and its one recent CVE never reach production.
jwt-decode: Why Decoding Is Not Verifying (Security Guide)
The npm jwt-decode package reads JWT claims without checking the signature. That is by design, and it is behind a whole class of authentication bypasses when developers forget it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.