What are the most common JWT security pitfalls?

Summary

Accepting alg: none or the wrong algorithm, not validating exp/aud/iss, using weak HMAC secrets, storing tokens in localStorage, putting sensitive data in the payload, very long expiry without revocation, and confusing ID tokens with access tokens.

Longer Answer

Always pin accepted algorithms when verifying, validate standard claims, use strong keys (or asymmetric RS256/EdDSA with JWKS rotation), keep access tokens short-lived (5–15 minutes) and use rotating refresh tokens. The payload is only base64-encoded, so anyone can read it. Validate tokens on every request, not just at the gateway, when services are reachable internally.

Key Points

• Pin algorithms
• Validate exp/aud/iss/nbf
• Strong keys, rotate via JWKS
• Short-lived access tokens
• Payload is not secret