Secure JWT Implementation Best Practices

JWTs are only as secure as their implementation. The spec is flexible; flexibility creates vulnerabilities. Follow these best practices to avoid the common pitfalls that have led to authentication bypasses in production systems.

Always specify the expected algorithm explicitly: jwt.decode(token, key, algorithms=["RS256"]). Never read the algorithm from the token header to select the verification key or code path. This prevents alg=none and key confusion attacks.

Access tokens: 15-60 minutes. Refresh tokens: 7-30 days, stored in httpOnly cookies (not localStorage). On expiry, the client uses the refresh token to get a new access token from the auth server without re-authentication.

Validate aud (audience) to ensure the token was issued for your service, not another. Validate iss (issuer) against your auth server URL. Without these checks, a token from another app signed by the same key would be accepted.

Access tokens in memory (JS variable) — cleared on tab close. Refresh tokens in httpOnly, Secure, SameSite=Strict cookies — inaccessible to JavaScript. Never store JWTs in localStorage — XSS can steal them.

JWTs are stateless — there is no built-in revocation. Options: maintain a revocation list (denylist) checked on each request; use very short expiry; use opaque tokens with a central lookup for high-security contexts.

Rotate signing keys regularly. Publish multiple keys in the JWKS with different kid values. During rotation: issue new tokens with new kid, keep old key active until old tokens expire, then remove old key from JWKS.

Never put sensitive data (passwords, SSNs, credit cards) in the JWT payload — it is base64url-encoded, not encrypted. Use JWE (JSON Web Encryption) if you need encrypted claims, or keep sensitive data server-side.

Transmit JWTs only over HTTPS. A JWT intercepted over HTTP gives full authentication bypass. Set the Secure flag on cookies. Use HSTS to prevent protocol downgrade. Never log full JWT strings in server logs.

Use well-maintained libraries: PyJWT 2+, python-jose, auth0/node-jsonwebtoken 9+, Nimbus JOSE + JWT (Java). Avoid implementing JWT verification from scratch. Check CVE databases regularly for library vulnerabilities.

Test all attack vectors: submit alg=none token, RS256→HS256 confusion token, expired token, wrong audience token, tampered payload. Use jwt.io to craft test tokens. Add integration tests that assert these are rejected with 401.

Where should refresh tokens be stored in a web application?

Secure JWT use requires pinned algorithms, short access token expiry, httpOnly cookie storage for refresh tokens, audience/issuer validation, and key rotation. Next: cryptographic secret sharing schemes.