You've read about OAuth 2.0 and decided to secure your web API using JWT access tokens. To implement this, you're likely relying on an open-source library to parse and validate these tokens, confident that your configuration will only accept tokens from your trusted issuer or token service.

But here's the real question: are you absolutely certain that your API only accepts access tokens issued by your service?

In this session, I’ll demonstrate some tricks that can bypass improperly configured token validation. You’ll see how easy it is to fool your API if you’re not careful. But don’t worry, I’ll also show how to write tests that ensure your application is protected against these exploits, keeping your data and users safe.

You will learn:

• How to identify Critical JWT Validation Vulnerabilities: Recognize common misconfigurations and hidden pitfalls in open-source token parsing libraries that leave web APIs exposed to bypass exploits.
• About Attack Vectors for Token Spoofing: Gain insight into the specific techniques attackers use to manipulate JWT headers, signatures, or claims to fool improperly secured validation logic.
• How to implement Automated Security Testing for APIs: Learn how to write effective, repeatable tests that continuously verify your application's token validation rules and protect against security regressions.