Validate JWT Tokens Securely

JWT Token Validator transforms Claude into an expert at validating, decoding, and securing JWT tokens with comprehensive security analysis, covering JWT structure, cryptographic algorithms, security vulnerabilities, and best practices for token validation across languages and frameworks. It documents the JWT structure, header, payload, and signature, and six critical validation steps: signature verification with the correct algorithm and key, algorithm validation to prevent algorithm-confusion attacks such as RS256 versus HS256, expiration checking against current time with clock-skew tolerance, issuer verification, audience validation, and not-before checking.

Use it when implementing or reviewing JWT validation logic: explicit algorithm allowlisting to prevent algorithm-confusion attacks, JWKS-based public-key fetching and caching for RS256, RS384, or RS512-signed tokens, comprehensive claim validation covering signature, exp, nbf, iat, aud, and iss plus custom business-logic claim checks such as active status or required scopes, and safe token inspection or decoding without verification for debugging. It is a security-focused validation and implementation guide across JavaScript, Python, and Go, not a JWT-issuing or signing guide, and its own recommendation is to use established JWT libraries rather than implementing validation from scratch.

Input is a JWT validation requirement - the language or framework, expected issuer and audience, signing algorithm, and whether keys come from a static secret or a JWKS endpoint. Output is validation code: an explicit-algorithm JWT verification function in JavaScript using jsonwebtoken, a full JWTValidator class in Python that fetches and caches public keys from a JWKS URL by key ID, validates all standard claims plus custom claims, and returns structured valid or error results, a Go implementation preventing algorithm-confusion attacks by checking the signing method before trusting the header's declared algorithm, a token-inspection function that decodes without verifying and reports security issues such as an "alg: none" header and expiration status, and a YAML production configuration block for algorithms, issuer and audience, clock skew, JWKS caching, and custom validation rules.

// SECURE: Explicitly specify allowed algorithms
const jwt = require('jsonwebtoken');

function validateToken(token, secret) {
  try {
    const decoded = jwt.verify(token, secret, {
      algorithms: ['HS256'], // Explicitly allow only specific algorithms
      issuer: 'your-app.com',
      audience: 'api.your-app.com',
      clockTolerance: 30 // 30 seconds clock skew tolerance
    });
    return { valid: true, payload: decoded };
  } catch (error) {
    return { valid: false, error: error.message };
  }
}

Documented libraries include Node's jsonwebtoken, Python's jwt, PyJWT, with cryptography for JWK-to-PEM conversion and requests for JWKS fetching, and Go's github.com/dgrijalva/jwt-go. Production configuration is expressed as YAML covering allowed algorithms, issuer and audience lists, clock-skew tolerance, a JWKS URL with cache TTL and timeout, and custom validation rules such as required scopes and maximum token age.

Backend and security engineers implementing or auditing JWT token validation across JavaScript, Python, or Go who want algorithm-confusion-safe, claim-complete validation logic and a production configuration reference, rather than hand-rolling or partially validating JWTs.