JWT Forgery Lab
Tamper with a JSON Web Token — strip the signature, flip a claim, and watch a vulnerable "verify" endpoint accept it anyway.
A JWT is only as trustworthy as the verification behind it. Strip the signature, flip a claim from user to admin, and hand it to an endpoint that decodes without verifying — this lab lets you watch that succeed, then see what stops it.
How to use it
- Decode the token and read its claims.
- Change a claim — role, or user ID.
- Try the alg: none trick and see the vulnerable endpoint accept it.
What to take away
The alg header is attacker input
Any library that reads alg from the token to decide how to verify it has handed the attacker the decision. Pin the expected algorithm server-side.
RS256 to HS256 confusion
If a library accepts either, an attacker can sign with the public key as an HMAC secret — and the public key is, by definition, public.
Payloads are readable by design
Signing proves integrity, not confidentiality. Anything private in a JWT payload is already disclosed.
Frequently asked questions
What is the alg none attack?
Setting the header algorithm to "none" and removing the signature. Libraries that honoured that value would treat the unsigned token as valid — which is why every current library rejects it by default.
How should JWTs be verified properly?
Pin the algorithm server-side, verify the signature with a key you control, then check exp, iss and aud. Skipping any of those is a finding.
Are JWTs a bad idea?
They are a reasonable tool that is frequently misused — especially as sessions, where their inability to be revoked before expiry is a genuine drawback.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- JWT Decoder — Decode a JSON Web Token's header and payload and read its claims. No signature verification.
- OAuth Redirect URI Hijack Lab — An authorization server validates redirect_uri loosely. Steal an authorization code by redirecting it to your own endpoint.
- Webhook Signature Forgery Lab — Forge an HMAC-signed webhook without the secret, then flip on signature verification and watch it get rejected.
- BOLA/BFLA Playground — A fake employee-directory API. Read a record that isn't yours, then call an admin-only action with no admin role at all.