JSON Web Tokens (JWTs) are an open, industry standard method for representing claims securely between two parties. There are numerous implementations for JWT verification but it looks like each author is testing his implementation on his own. It would be great if there was a tool or fuzzer to verify a given implementation is compliant to the standard and is secure. A starting point could be the RFC 7520 document that describes fuzz vectors and examples for fuzz testing.

Is there such a tool already?

Or people are testing JWT in the other way?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.