--- id: CP-195 slug: jwt-json-web-token-signature-pitfalls lang: en title: JSON Web Token (JWT) description: A JWT is the credential an application hands you after you sign in. What its signature checks, the pitfalls, and the habits to adopt. canonical_url: https://startbrain.io/cyberpedia/en/articles/jwt-json-web-token-signature-pitfalls/ markdown_url: https://startbrain.io/cyberpedia/en/articles/jwt-json-web-token-signature-pitfalls.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "JSON Web Token (JWT)", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/jwt-json-web-token-signature-pitfalls/ (CC BY 4.0) wing: 3 theme: control_access reflex: cr-027 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/jwt-json-web-token-signature-pitfalls/ fr: https://startbrain.io/cyberpedia/fr/articles/jwt-json-web-token-signature-pieges/ de: https://startbrain.io/cyberpedia/de/articles/jwt-json-web-token-signatur-fallstricke/ es: https://startbrain.io/cyberpedia/es/articles/jwt-json-web-token-firma-trampas/ sources: - "n": 1 title: Tokens and claims overview - Microsoft identity platform publisher: Microsoft url: https://learn.microsoft.com/en-us/entra/identity-platform/security-tokens published: "2025-03-21" accessed: "2026-11-03" - "n": 2 title: "Use Alternate Authentication Material: Application Access Token, Sub-technique T1550.001 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1550/001/ accessed: "2026-11-03" - "n": 3 title: Access tokens in the Microsoft identity platform - Microsoft identity platform publisher: Microsoft url: https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens published: "2025-05-14" accessed: "2026-11-03" - "n": 4 title: Steal Application Access Token, Technique T1528 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1528/ accessed: "2026-11-03" - "n": 5 title: Authentication - OWASP Cheat Sheet Series publisher: OWASP url: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html accessed: "2026-11-03" - "n": 6 title: Session Management - OWASP Cheat Sheet Series publisher: OWASP url: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html accessed: "2026-11-03" - "n": 7 title: Steal Web Session Cookie, Technique T1539 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1539/ accessed: "2026-11-03" --- # JSON Web Token (JWT) After you sign in to a company application, it hands you a digital credential that your browser or application then presents with every request. At Microsoft, this credential takes the form of a JSON Web Token, or JWT, which contains "claims", that is, statements about the user or the application [1]. A JWT can be decoded, for example with the jwt.ms site, and its signature is used to check the authenticity of the token [3]. This page covers what employees do and what managers do. ## In 30 seconds - Where it happens: with the Microsoft identity platform, which authenticates users and provides access, refresh and identity tokens [1]. - What the attacker wants: to steal a valid token so as to act with its owner's rights, without knowing the password [2]. - The reflex: never send or publish a token or an address that contains one, sign out after use, and report any abnormal behavior. - If it has already happened: sign out, then notify the IT department. OWASP points out that deleting a cookie is not enough: "deleting a cookie alone does not invalidate a stolen copy of the session ID", and server-side invalidation is needed [6]. ## Straight answers ### What is a JWT? A JWT has three segments separated by a dot: the header, the body and the signature [3]. The body contains the claims. The signature is used to assess the authenticity of the token [3]. ### Does the signature stop the token from being read? The signature is used to check the authenticity of the token. Microsoft states that developers can decode a JWT with a site such as jwt.ms, for validation and debugging purposes [3]. The token is sensitive and poses a security risk if it is mishandled [3]. ### Does a stolen token really let someone act in my place? Yes. MITRE describes adversaries who use stolen access tokens to bypass the usual authentication process and access accounts, information or services. These tokens are used in place of login credentials [2]. ### Does a stolen token stay valid for long? That depends on its lifetime. For Microsoft access tokens, the default lifetime is a random value between 60 and 90 minutes, 75 minutes on average [3]. Tenants without conditional access have a default lifetime of two hours for clients such as Microsoft Teams and Microsoft 365 [3]. MITRE notes, however, that the adversary can sometimes steal a refresh token as well, which lets them obtain new access tokens without involving the user [4]. ## How it works The authorization server signs the token with a private key and publishes the matching public key. To validate a token, the application checks the signature with this public key [1]. The JWT header gives the signing algorithm (the `alg` claim) and the public key to use (the `kid` claim) [3]. Microsoft Entra ID issues tokens signed with standard asymmetric algorithms, such as RS256 [3]. The access token is passed to an API as a "bearer" token in the Authorization header [1]. Because tokens are valid for a limited time, the server often provides a pair: an access token and a refresh token, which is used to renew the first when it nears expiry [1]. The refresh token yields a new access token only if the user is still authorized [1]. In the case of OpenID Connect, the ID Token is a signed JWT that lets an application verify the user's identity [5]. ## What you do As an employee: - Never send a token, or a web address that contains one, in a message, a ticket or a forum. Session identifiers placed in an address can end up in links, logs, browser history, bookmarks, the Referer header or search engines [6]. - Sign out when you are done. An application must offer a visible and accessible sign-out button, so that the user can close their session at any time [6]. - Do not count on closing the browser: it cannot reliably force a sign-out, especially on mobile [6]. - Report abnormal behavior (unexpected sign-outs, actions you did not take, a request to authorize an unknown application). MITRE describes attackers who get access granted to a malicious application by sending a targeted phishing link [4]. As a manager, to require from teams and suppliers: - Validation of the signature and the issuer by the application that receives the token, with the values published in the OpenID discovery document [3]. - Audience checking: an API must accept only tokens whose `aud` claim matches it. Accepting a token intended for another resource is an example of the "confused deputy" problem [3]. - Proven libraries rather than in-house code. Microsoft recommends its MSAL libraries, which handle obtaining, refreshing and validating tokens [1]. - Limited session lifetimes. OWASP cites 2 to 5 minutes of idle timeout as common ranges for high-value applications and 15 to 30 minutes for low-risk ones, and also asks for an absolute timeout regardless of activity [6]. - Careful storage on the browser side (see the next section). ## Pitfalls MITRE states that stolen tokens are "used in lieu of login credentials", that is, in place of login credentials [2]. MITRE notes that session cookies can bypass some multi-factor authentication protocols [7]. Several implementation mistakes recur in the sources. - Storage in the browser. OWASP advises against storing authentication tokens, session identifiers, JWTs or refresh tokens in localStorage or sessionStorage: these spaces are accessible to any JavaScript running in the origin, so a single XSS flaw discloses all the tokens [6]. OWASP prefers HttpOnly, Secure and SameSite=Strict cookies, or a Backend-for-Frontend type of model [6]. - The token in the address. An identifier passed in the URL can leak and make other attacks easier, such as session fixation [6]. - Validation in the wrong place. According to Microsoft, a client must not try to validate an access token: that is the API's job, and the client treats it as an opaque string [3]. - Trusting the content without verifying the signature. An application that must validate a token starts by verifying the signature and the issuer [3]. - Tokens stolen from the infrastructure. In Kubernetes environments or continuous integration and deployment pipelines, API tokens can be stolen if the container or the pipeline is compromised [4]. - Session theft by a malicious script or a phishing proxy. MITRE cites malware that targets browser cookies, and free tools such as Evilginx2 and Muraena that collect cookies through a malicious proxy [7]. The sources cited here do not detail other frequently cited design mistakes, such as the "none" algorithm, key confusion or weak secrets. Development teams should have this point checked against their own reference documents. ## Sources 1. Microsoft, "Tokens and claims overview - Microsoft identity platform", 21 March 2025. https://learn.microsoft.com/en-us/entra/identity-platform/security-tokens (accessed 3 November 2026) 2. MITRE ATT&CK, "Use Alternate Authentication Material: Application Access Token, Sub-technique T1550.001 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1550/001/ (accessed 3 November 2026) 3. Microsoft, "Access tokens in the Microsoft identity platform - Microsoft identity platform", 14 May 2025. https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens (accessed 3 November 2026) 4. MITRE ATT&CK, "Steal Application Access Token, Technique T1528 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1528/ (accessed 3 November 2026) 5. OWASP, "Authentication - OWASP Cheat Sheet Series". https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html (accessed 3 November 2026) 6. OWASP, "Session Management - OWASP Cheat Sheet Series". https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html (accessed 3 November 2026) 7. MITRE ATT&CK, "Steal Web Session Cookie, Technique T1539 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1539/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/jwt-json-web-token-signature-pitfalls/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.