Safely Handling JWTs

• node-jsonwebtoken

  15 17,378 4.5 JavaScript

  JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html

  

Don't write your own decode or verify functions, use a library like https://github.com/auth0/node-jsonwebtoken.

• frank_jwt

  355 250 3.1 Rust

  JSON Web Token implementation in Rust.

Below is an example of a access token that is a JWT in encoded and decoded form using https://jwt.io

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• jwt-secrets

  2 591 5.7
  

A final note on symmetric algorithms is that the secret used to create the signature needs to be unique, sufficiently large and complex to prevent it being brute forced. There have also been instances where people have forgotten to change the default secret included with the package or example code they used. These have been compiled into helpful word-lists such as Wallarm's JWT Secrets list. This allows attackers to quickly check if your JWT is signed with something from an example rather than a traditional brute force.

Suggest a related project