Exploiting JSON Web Key (JWK)

JWTs are everywhere. They are the stateless session token of choice for modern web applications. But with great convenience comes a long tail of misconfigurations that turn a robust cryptographic standard into a wide-open door.

This post explores one of the more elegant attacks in the JWT ecosystem: JWK injection. By the end, you will understand how a misplaced trust in the jwk header parameter can let an attacker forge tokens at will, and — more importantly — how to shut it down.