Implements secure JWT (RFC 7519) signing and verification using HMAC-SHA256, RSA-PSS, ES256, and EdDSA, including token expiration, claims validation, and defenses against algorithm-confusion, none-algorithm, and key-injection attacks. Use when adding or hardening JWT-based authentication/authorization, or when auditing token verification code for common JWT vulnerabilities.
Start a fresh conversation. Replace the highlighted placeholders.
Use implementing-jwt-signing-and-verification to harden JWT signing and verification for [application behavior and JWT claim requirements] in an authorized test environment, using an explicit algorithm allowlist, standard-claim validation, key rotation support, and tests that reject tampering, expiration, algorithm confusion, and alg=none. Use synthetic fixtures only, report actual test status, never request or expose secret values, and stop for explicit confirmation before changing a live authentication system.
Required inputs
[application behavior and JWT claim requirements]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: implementing-jwt-signing-and-verificationdescription: >- Implements secure JWT (RFC 7519) signing and verification using HMAC-SHA256, RSA-PSS, ES256, and EdDSA, including token expiration, claims validation, and defenses against algorithm-confusion, none-algorithm, and key-injection attacks. Use when adding or hardening JWT-based authentication/authorization, or when auditing token verification code for common JWT vulnerabilities.domain: cybersecuritysubdomain: cryptographytags: - cryptography- jwt- authentication- token-security- digital-signaturesversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - PR.DS-01- PR.DS-02- PR.DS-10mitre_attack: - T1600- T1573- T1553
Implementing JWT Signing and Verification
Overview
JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization in web applications. This skill covers implementing secure JWT signing with HMAC-SHA256, RSA-PSS, and EdDSA algorithms, along with verification, token expiration, claims validation, and defense against common JWT attacks (algorithm confusion, none algorithm, key injection).
When to Use
When deploying or configuring implementing jwt signing and verification capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Objectives
Implement JWT signing with HS256, RS256, ES256, and EdDSA
Verify JWT signatures and validate standard claims
Implement token expiration, not-before, and audience validation
Defend against algorithm confusion and none algorithm attacks
Implement JWT key rotation with JWK Sets
Build a complete authentication middleware
Key Concepts
JWT Algorithms
Algorithm
Type
Key
Security Level
HS256
Symmetric (HMAC)
Shared secret
128-bit
RS256
Asymmetric (RSA)
RSA key pair
112-bit
ES256
Asymmetric (ECDSA)
P-256 key pair
128-bit
EdDSA
Asymmetric (Ed25519)
Ed25519 pair
128-bit
Common JWT Attacks
Algorithm confusion: Switching from RS256 to HS256, using public key as HMAC secret
None algorithm: Setting alg=none to bypass signature verification
Key injection: Embedding key in JWK header
Weak secrets: Brute-forcing short HMAC secrets
Token replay: Reusing valid tokens without expiration
Security Considerations
Always validate the algorithm header against an allowlist
Never accept alg=none in production
Use asymmetric algorithms (RS256, ES256) for distributed systems
Set short expiration times (15 min for access tokens)
Implement token refresh mechanism
Store secrets securely (not in source code)
Validation Criteria
JWT signing produces valid tokens for all algorithms