JWT Security Review Prompt
Review JWT usage for the known traps — alg confusion, missing signature/expiry checks, secrets in the token, and the revocation problem stateless tokens create.
Overview
JWTs concentrate a lot of trust in a signed string, and the failure modes are specific and well-known. This prompt reviews JWT usage for them: algorithm confusion and 'none', whether signature and expiry are actually verified, what's stored in the (readable) payload, where tokens live client-side, and how revocation works — the problem stateless tokens famously create.
Why This Works
- JWT flaws are specific and repeatable — a targeted checklist beats a generic read
- Alg confusion and 'none' are the classic JWT criticals worth a dedicated pass
- Forcing the revocation question surfaces the gap stateless tokens hide
Best for
- APIs and SPAs using JWTs for auth
- Code after rolling your own token handling
- Security review of stateless auth
Not for
- Choosing sessions vs tokens — use the Authentication Strategy Prompt
- Reviewing server-side sessions — use the Session Management Review Prompt
Use cases
- Reviewing a JWT-based auth implementation
- Checking for alg confusion and unverified signatures
- Assessing the token revocation story before launch