Resource
Code Review Prompt — the Review Contract
"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.
JWT Security Review Prompt
Review JWT usage for the known traps — alg confusion, missing signature/expiry checks, secrets in the token, and the revocation problem stateless tokens create.
Overview
JWTs concentrate a lot of trust in a signed string, and the failure modes are specific and well-known. This prompt reviews JWT usage for them: algorithm confusion and 'none', whether signature and expiry are actually verified, what's stored in the (readable) payload, where tokens live client-side, and how revocation works — the problem stateless tokens famously create.
How to use this resource
-
Gather the JWT implementation
Collect the code that issues, verifies, and stores your JWTs, plus what the payload carries. The review checks the well-known JWT traps against it.
-
Open this resource in Code Review Prompt Generator
Load the prompt into Code Review Prompt Generator and paste in the JWT code. It reviews for algorithm confusion, missing signature or expiry checks, and secrets in the token.
-
Review the JWT findings
Read each finding - an unverified signature, a none-algorithm path, sensitive data in the readable payload, an unworkable revocation story - by risk.
-
Fix the traps and re-review
Address the flagged issues, especially signature and expiry verification and revocation, then re-run the review to confirm they are closed.
Why This Works
- JWT flaws are specific and repeatable — a targeted checklist beats a generic read
- Alg confusion and 'none' are the classic JWT criticals worth a dedicated pass
- Forcing the revocation question surfaces the gap stateless tokens hide
Best for
- APIs and SPAs using JWTs for auth
- Code after rolling your own token handling
- Security review of stateless auth
Not for
- Choosing sessions vs tokens — use the Authentication Strategy Prompt
- Reviewing server-side sessions — use the Session Management Review Prompt
Use cases
- Reviewing a JWT-based auth implementation
- Checking for alg confusion and unverified signatures
- Assessing the token revocation story before launch
FAQ
How does this prompt catch RS256 to HS256 algorithm confusion in JWT verification?
Step 1 (ALGORITHM) checks whether the algorithm is pinned server-side, then hunts the RS256-to-HS256 confusion path where an attacker signs a token with the public RSA key treated as an HMAC secret. The severity block tags alg confusion and 'none' acceptance as CRITICAL. The generated prompt reports these where the verification code lives; run it in ChatGPT, Claude, or Gemini and apply the fix yourself.
Which JWT claims and payload contents does the review treat as red flags?
Step 4 (PAYLOAD) flags anything sensitive sitting in the readable, unencrypted payload — secrets, PII, internal IDs — since anyone can base64-decode a JWT. Step 7 (CLAIMS TRUST) separately checks whether authorization rests on claims a client could influence, while step 3 enforces exp plus nbf and iat where relevant. It names the exposure and trust gaps; what to strip or move server-side stays your decision.
Why does the review force a revocation answer for stateless JWTs?
Step 6 (REVOCATION) makes you account for how a token is invalidated before expiry — on logout or compromise — or document the accepted fact that it cannot be, the gap stateless tokens hide. It pairs with step 5 (STORAGE), which weighs localStorage XSS exposure against an httpOnly cookie. The review names the gap and the trade-off taken; choosing a denylist, short expiry, or accepted risk is your call.
More resources from Code Review Prompt Generator
Resource
Security Code Review Prompt
Twelve security checks — injection, auth, secrets, SSRF, privilege escalation — reviewed the way an attacker would read the code.
Resource
API Review Checklist Prompt
Architecture review for the public surface: abstractions that earn their place, dependency direction, seams, and the patterns the codebase already has.
Resources that pair well
Resource
Refactor Prompt — the Behavior Preservation Contract
"Refactor this code" invites silent behavior changes. The refactoring contract preserves business rules, outputs, and side effects — and flags uncertainty instead of deciding it.
Resource
Playwright Test Prompt
getByRole over CSS chains, auto-wait over sleep, web-first assertions — Playwright tests written the way Playwright wants.
Resource
Compare Two ChatGPT Prompts
A side-by-side way to decide between two ChatGPT prompt drafts — scored on clarity, specificity, output control, and risk instead of gut feeling.
Related tools
Tool
Code Review Prompt Generator
Generate code review prompts for any scope — snippet, file, diff, or full pull request — with focused review rules.
Guides for this resource
Guide
How to Plan an OAuth or SSO Integration With AI
SSO arrives as a checkbox and lands as a lifecycle. Plan the integration before you build it: the identity key, the linking rule that isn't account takeover, what a provider's groups may and may not grant, and what happens when somebody leaves.