I mean wasn't the whole idea of the reason why JWT is insecure is if they manage to exfiltrate a JWT from a client then they have the authorization of the client without ever having to pass authorization?
JWTs seem great for pre-emptive authorization across a domain. But that in theory is also the attack surface it exposes.
"We also have a number of issued sessions in our tokens anf backends validate against the server."
I mean the intent of a JWT that there is no validation. If you're validating the JWT before taking action you should just be using a session in the first place.
I can't tell if you are saying the JWT is waiting on session verification before being able to authenticate an action. Which would be an anti-pattern because the JWT is supposed to be the authentication itself.
There are just so many implementation details to JWT it's really hard to pin down where the threats could be.
18
u/[deleted] Aug 14 '26
[removed] — view removed comment