5 JWT Security Mistakes We Find in Every Audit

1. Tokens in localStorage

Any XSS vulnerability becomes full account takeover when tokens sit in localStorage. Use HttpOnly, Secure, SameSite cookies for browser sessions; reserve localStorage tokens for native apps with certificate pinning. This single change neutralizes the most common token-theft path.

2. No rotation or revocation

JWTs without expiry under 15 minutes plus refresh-token rotation leave stolen tokens valid for days. Implement short-lived access tokens, rotating refresh tokens with reuse detection, and a revocation list for logout and password changes.

3. Algorithm confusion

Accepting alg: none or trusting the token's declared algorithm invites signature bypass. Hardcode the expected algorithm server-side (RS256 with proper key management) and reject everything else explicitly.

4. Bloated payloads

Stuffing roles, permissions, and PII into tokens bloats every request and leaks data to anyone decoding base64. Keep the subject ID only; resolve permissions server-side per request.

5. Missing audience checks

Tokens minted for one service accepted by another enable cross-service replay. Validate aud and iss claims on every verification. Full audit service: /services/cybersecurity-audit.