Cyberpediaby Brain
ENDEFR

JSON Web Token (JWT)

A JWT is the credential an application hands you after you sign in. What its signature checks, the pitfalls, and the habits to adopt.

In 30 seconds

Where it happens
With the Microsoft identity platform, which authenticates users and provides access, refresh and identity tokens1.
What the attacker wants
To steal a valid token so as to act with its owner's rights, without knowing the password2.
The reflex
Never send or publish a token or an address that contains one, sign out after use, and report any abnormal behavior.
If it has already happened
Sign out, then notify the IT department. OWASP points out that deleting a cookie is not enough: "deleting a cookie alone does not invalidate a stolen copy of the session ID", and server-side invalidation is needed6.

What it is

After you sign in to a company application, it hands you a digital credential that your browser or application then presents with every request. At Microsoft, this credential takes the form of a JSON Web Token, or JWT, which contains "claims", that is, statements about the user or the application1.

A JWT can be decoded, for example with the jwt.ms site, and its signature is used to check the authenticity of the token3. This page covers what employees do and what managers do.

Straight answers

What is a JWT?

A JWT has three segments separated by a dot: the header, the body and the signature3. The body contains the claims. The signature is used to assess the authenticity of the token3.

Does the signature stop the token from being read?

The signature is used to check the authenticity of the token. Microsoft states that developers can decode a JWT with a site such as jwt.ms, for validation and debugging purposes3. The token is sensitive and poses a security risk if it is mishandled3.

Does a stolen token really let someone act in my place?

Yes. MITRE describes adversaries who use stolen access tokens to bypass the usual authentication process and access accounts, information or services. These tokens are used in place of login credentials2.

Does a stolen token stay valid for long?

That depends on its lifetime. For Microsoft access tokens, the default lifetime is a random value between 60 and 90 minutes, 75 minutes on average3. Tenants without conditional access have a default lifetime of two hours for clients such as Microsoft Teams and Microsoft 3653. MITRE notes, however, that the adversary can sometimes steal a refresh token as well, which lets them obtain new access tokens without involving the user4.

1How it works1 min

The authorization server signs the token with a private key and publishes the matching public key. To validate a token, the application checks the signature with this public key1. The JWT header gives the signing algorithm (the alg claim) and the public key to use (the kid claim)3. Microsoft Entra ID issues tokens signed with standard asymmetric algorithms, such as RS2563.

The access token is passed to an API as a "bearer" token in the Authorization header1. Because tokens are valid for a limited time, the server often provides a pair: an access token and a refresh token, which is used to renew the first when it nears expiry1. The refresh token yields a new access token only if the user is still authorized1.

In the case of OpenID Connect, the ID Token is a signed JWT that lets an application verify the user's identity5.

2What you do2 min

As an employee:

  • Never send a token, or a web address that contains one, in a message, a ticket or a forum. Session identifiers placed in an address can end up in links, logs, browser history, bookmarks, the Referer header or search engines6.
  • Sign out when you are done. An application must offer a visible and accessible sign-out button, so that the user can close their session at any time6.
  • Do not count on closing the browser: it cannot reliably force a sign-out, especially on mobile6.
  • Report abnormal behavior (unexpected sign-outs, actions you did not take, a request to authorize an unknown application). MITRE describes attackers who get access granted to a malicious application by sending a targeted phishing link4.

As a manager, to require from teams and suppliers:

  • Validation of the signature and the issuer by the application that receives the token, with the values published in the OpenID discovery document3.
  • Audience checking: an API must accept only tokens whose aud claim matches it. Accepting a token intended for another resource is an example of the "confused deputy" problem3.
  • Proven libraries rather than in-house code. Microsoft recommends its MSAL libraries, which handle obtaining, refreshing and validating tokens1.
  • Limited session lifetimes. OWASP cites 2 to 5 minutes of idle timeout as common ranges for high-value applications and 15 to 30 minutes for low-risk ones, and also asks for an absolute timeout regardless of activity6.
  • Careful storage on the browser side (see the next section).
3Pitfalls2 min

MITRE states that stolen tokens are "used in lieu of login credentials", that is, in place of login credentials2. MITRE notes that session cookies can bypass some multi-factor authentication protocols7.

Several implementation mistakes recur in the sources.

  • Storage in the browser. OWASP advises against storing authentication tokens, session identifiers, JWTs or refresh tokens in localStorage or sessionStorage: these spaces are accessible to any JavaScript running in the origin, so a single XSS flaw discloses all the tokens6. OWASP prefers HttpOnly, Secure and SameSite=Strict cookies, or a Backend-for-Frontend type of model6.
  • The token in the address. An identifier passed in the URL can leak and make other attacks easier, such as session fixation6.
  • Validation in the wrong place. According to Microsoft, a client must not try to validate an access token: that is the API's job, and the client treats it as an opaque string3.
  • Trusting the content without verifying the signature. An application that must validate a token starts by verifying the signature and the issuer3.
  • Tokens stolen from the infrastructure. In Kubernetes environments or continuous integration and deployment pipelines, API tokens can be stolen if the container or the pipeline is compromised4.
  • Session theft by a malicious script or a phishing proxy. MITRE cites malware that targets browser cookies, and free tools such as Evilginx2 and Muraena that collect cookies through a malicious proxy7.

The sources cited here do not detail other frequently cited design mistakes, such as the "none" algorithm, key confusion or weak secrets. Development teams should have this point checked against their own reference documents.

Fact sheet

Identifier
CP-195
Wing
3. Protocols and defence
Brain skill
Controlling Access (control_access)
Brain reflex
cr-027
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. Microsoft, “Tokens and claims overview - Microsoft identity platform”, 21 March 2025. https://learn.microsoft.com/en-us/entra/identity-platform/security-tokens (accessed 3 November 2026)
  2. MITRE ATT&CK, “Use Alternate Authentication Material: Application Access Token, Sub-technique T1550.001 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1550/001/ (accessed 3 November 2026)
  3. Microsoft, “Access tokens in the Microsoft identity platform - Microsoft identity platform”, 14 May 2025. https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens (accessed 3 November 2026)
  4. MITRE ATT&CK, “Steal Application Access Token, Technique T1528 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1528/ (accessed 3 November 2026)
  5. OWASP, “Authentication - OWASP Cheat Sheet Series”. https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html (accessed 3 November 2026)
  6. OWASP, “Session Management - OWASP Cheat Sheet Series”. https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html (accessed 3 November 2026)
  7. MITRE ATT&CK, “Steal Web Session Cookie, Technique T1539 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1539/ (accessed 3 November 2026)

Cite this article

Brain, “JSON Web Token (JWT)”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/jwt-json-web-token-signature-pitfalls/

BibTeX 
@misc{brain_cp195_en_2026,
  author = {Brain},
  title = {JSON Web Token (JWT)},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/jwt-json-web-token-signature-pitfalls/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence