JWT Pros and Cons

In my previous blog post, I covered the fundamentals of JWTs, including their structure, security features, and common use cases. In this article, I'll explore the advantages and disadvantages of using JWTs.

Advantages of JWT
Its small size allows a JWT to be included in a URL, a POST parameter, or an HTTP header, enabling quick transmission without requiring additional server calls for validation.

More compact
Since JWT is less verbose than XML, it is much smaller when encoded, making it a great choice for use in HTML and HTTP environments.

More Secure
JWTs are secure because they can use public/private key pairs through X.509 certificates or be symmetrically signed with a shared secret using HMAC. While SAML tokens also support public/private keys, signing XML is more complex and prone to security issues than the straightforward process of signing JSON with JWT.

More Common
JSON is widely supported across programming languages and directly maps to objects, making JWT easier to work with.

Easier to Process
JWT is designed for internet-scale use, making it easier to process on users' devices, especially mobile ones.

Source: auth0 Docs

The strength of JWT lies in its digital signature. Even if someone steals a token, they cannot forge a valid signature or alter the claims without the private key. In other words, JWT provides strong protection against tampering and reliably verifies the issuer.

The essential aspects of using JWTs are:

1. The private key must be securely managed on the server side and used only for signing. It should never be shared with any third parties.
2. The public key is distributed to the verifying party and used for validating signatures.
3. Public/private key pairs can be easily generated using tools like OpenSSL, and libraries such as Node.js can handle JWT signing and verification.

Disadvantages of JWT
Referencing several websites (listed below), I have selected a list of common drawbacks of JWTs:

Token Size
JTWs include claims (data) and a signature, which makes them larger than other token formats. This can lead to increased network usage, particularly problematic in bandwidth-limited environments.

Lack of Built-in Revocation
JWTs typically have a predefined expiration time but no built-in mechanism to revoke tokens. Once issued, a JWT remains valid until it expires, even if it needs to be invalidated sooner (e.g., after user logout or token compromise). Developers must implement additional mechanisms, such as maintaining a blacklist of revoked tokens, to address this limitation.

Lack of Encryption
The payload of a JWT is not encrypted, meaning the data is visible if the token is intercepted. While signatures ensure data integrity, they do not provide confidentiality. Sensitive information should not be included in the payload unless encryption is applied separately.

Token Leakage
JWTs are stored on the client side (e.g., in localStorage or cookies), which makes them vulnerable to client-side attacks like Cross-Site Scripting (XSS). If stolen, tokens can be reused by attackers. Developers should follow best practices for secure token storage and implement measures to prevent XSS.

Algorithm Vulnerabilities
Using weak or outdated cryptographic algorithms increases the risk of attacks.

The JWT header specifies the algorithm used (e.g., { "alg": "HS256", "typ": "JWT" }) and is part of the token itself. Servers might implicitly trust this client-provided input, allowing attackers to exploit the algorithm choice (e.g., by changing alg to none to bypass verification).

To mitigate this, developers should enforce strong algorithms (e.g., RS256 or HS256 ) and ensure servers validate tokens securely without relying on the client-provided alg value.

Sources:
Permify
Articles
SecOpsSolution
PortSwigger

JWTs are widely used and are increasingly becoming a popular choice for token-based authentication. However, while they offer many advantages, it's crucial to implement additional security measures to mitigate their potential drawbacks effectively.