JWT Jiu-Jitsu

Bootcamp: Rapid Threat Modeling with GenAI & LLMs - June 6-7, 2024. Only 5 seats left - Secure your spot!
Learning Path
Advanced Application Security
Ideal for
Security Engineer
Security Architect
Security Champion
Cloud Labs

For any modern web application, authentication and authorization are key components of the security posture. In recent years, JSON Web Token (JWT) has become one of the leading technology standards used to secure and protect web apps of all kinds. Loved by many but hated by cryptographers, JWT is used extensively in OAuth, OIDC, Kubernetes, and other distributed web services and microservices.

In this course, we’ll be learning about JSON Web Token with a focus on attacking vulnerable JWT implementations and looking at defense strategies. We start with an introduction to JWT and why we need it. We’ll also explore the essentials of JWTs with cryptography.

Most of our time will be spent taking a deep-dive into attacking JWTs. This includes JWT algorithm confusion, authentication bypass, mutable claims attack, and HMAC brute force attacks, among others. Every single one of our lessons will be taught with the help of lab exercises to give you a hands-on look at real-world methods used to attack JSON Web Tokens.

All of AppSecEngineer’s video lessons and labs have been carefully crafted to deliver high-quality training while helping you retain as much of it as possible. All our material is designed to deliver real-world problem-solving experience. When you finish this course, you’ll be able to directly apply what you’ve learned to secure web apps with JWT.

You might also like these courses

Or explore these Learning Paths


JWT Algorithm Confusion

JKU Authentication Bypass

JWT Mutable Claims Attack

Bruteforcing JWT HMAC Keys

Hands-on. Defensive. Bleeding-Edge.

There's no other training platform that does all three. Except AppSecEngineer.
Get Our Newsletter
Get Started

Contact Support

1603 Capitol Avenue,
Suite 413A #2898,
Cheyenne, Wyoming 82001,
United States

Copyright AppSecEngineer © 2023