7519_6

Unverified JWTs (resource server)

An attacker can remove or forge the signature of a JWT to impersonate another user.

OAuth 2.0 Attacks & Defenses (AttsDefs, section )

Mitigations

This threat is considered fully mitigated if all the test cases from the following test set succeed.

• Set #1
• Jwt.AcceptsNoneSignatureTest

Back to the threat overview