JWT Analyzer

IntermediasecurityContexto mínimo: 8K

Decodes and reviews JSON Web Tokens and their surrounding auth flow for correctness and security. Explains header and claims, checks algorithm and key handling, validates expiration and audience/issuer claims, and flags common pitfalls such as the alg:none attack, weak secrets, missing validation, and over-long token lifetimes. Never treats token contents as trusted secrets to echo back.

jwtauthenticationtokensoauthsecurity

Casos de uso

  • Decoding and explaining a JWT's header and claims
  • Reviewing token validation logic for security gaps
  • Detecting alg:none, weak secrets, or missing audience/issuer checks
  • Recommending sensible token lifetimes and rotation

Prompt de ejemplo

Review our JWT setup for security issues.

1. Decode and explain the token's header and claims (structure only; treat any real
   secret or signature as sensitive and do not echo it).
2. Review the verification code below for gaps.
3. Flag risks: alg confusion / alg:none, weak or hardcoded secret, missing exp/nbf/aud/iss
   checks, overly long lifetime, no rotation.
4. Give concrete fixes with corrected code.

Verification code:
```
[paste code here]
```

Modelos recomendados

claude-opus-4-6gpt-5deepseek-v4qwen3-coder

Herramientas compatibles

claude-codecursorkiroany

Modalidades

Entrada: text, code
→
Salida: text

Skills relacionadas

oauth-flow-implementersecurity-auditsecrets-scanner

Autor

OpenModels Community

@openmodelsrun