{"slug":"jwt-verification-review","name":"JWT Verification Review","version":"1.0.0","updated_at":"2026-10-26T21:00:06.010Z","use_when":"Reviews ONE piece of code that verifies JSON Web Tokens for the five mistakes that let a forged or stale token in, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches an algorithm taken from the token header or no fixed algorithm list, an expiry check switched off, neither audience nor issuer checked, a payload read with decode where verify is needed, and a signing secret written into the source. It leaves out the safe look-alikes, such as an algorithm list fixed in the verify call, an audience compared in a second step, and a decode that only reads the key id. Use to review login middleware, to audit token handling in a service, or to check an API before release.","not_for":"OAuth redirect flows, session cookies that are not tokens, key rotation schedules, token storage in the browser and the internals of a library. It reads one piece of pasted verification code and judges only what is written in it.","languages":["en"],"tags":["jwt","authentication","token-verification","api-security","node","code-review"],"category":"code","category_url":"https://aiskills402.com/categories/code","keywords":["login middleware","signing secret","expiry check","algorithm list"],"faq":[{"q":"Algorithm list fixed to one name: reported?","a":"No. A fixed list in the verify call is the accepted form, whichever algorithm it names. The line is for a list taken back from the token header, for allowing none, or for a call that gives no list at all."},{"q":"Audience compared by hand after verify: reported?","a":"No. Comparing the claim in a second step counts as checking it, and one of audience or issuer is enough. The line appears only when neither is compared anywhere in the code."},{"q":"What code went into the test?","a":"Three small Node modules of our own. An orders middleware with a literal secret and expiry ignored, a session reader that trusts the header for the algorithm and uses decode to find admins, and a billing verifier that is correct. Claude Sonnet and Claude Haiku each reviewed every module once."},{"q":"What does a sound verifier return?","a":"Just the sentence No findings., nothing around it. A real problem arrives as its own line carrying a code, a function name, what goes wrong and how to repair it. The skill does not list what it looked at and approved."}],"examples":[{"lang":"en","model":"claude-sonnet-5-5","input_excerpt":"const jwt = require('jsonwebtoken');\n\nconst SECRET = 'k9Zp2-vQx7mL4tRw-81fd30';\n\nfunction requireAuth(req, res, next) {\n  const token = (req.headers.authorization || '').replace('Bearer ', '');\n  try {\n    const claims = jwt.verify(token, SECRET, {\n      algorithms: ['HS256'],\n      ignoreExpiration: true,\n    });\n    if (claims.aud !== 'orders-api') {\n      return res.sendStatus(403);\n    }…","output_excerpt":"NO-EXP-CHECK — requireAuth, `ignoreExpiration: true` — the expiry check is switched off, so a stolen or old token stays valid forever — remove the option so `exp` is enforced\nHARDCODED-SECRET — requireAuth, `const SECRET = 'k9Zp2-vQx7mL4tRw-81fd30'` — the signing secret is in the source and in version control, so anyone with the code can forge tokens — read it from the environment or a secret…"}],"page_url":"https://aiskills402.com/skills/jwt-verification-review","markdown_url":"https://aiskills402.com/skills/jwt-verification-review.md","image_url":"https://cdn.aiskills402.com/og/skills/jwt-verification-review/f43746d0.png","related_url":"https://api.aiskills402.com/v1/skills/jwt-verification-review/related","purchases_count":null,"tested":{"date":"2026-10-26","strong":{"model":"claude-sonnet-5-5 (Claude Code alias \"sonnet\")","verdict":"Right on all 3 cases, read by hand. On the orders middleware it found the expiry check switched off and the secret typed into the source, and left out the algorithm list fixed to one name and the audience compared in a second step. On the session reader it found the algorithm taken from the token header and the admin decision read with decode, and left out the header read for the key id and the audience and issuer already passed to verify. On the clean billing verifier it answered exactly No findings."},"weak":{"model":"claude-haiku-5-5 (Claude Code alias \"haiku\")","verdict":"Right on all 3 cases, read by hand. It matched the strong model on both planted modules, with sound fixes, and kept every safe look-alike out of its list: the fixed algorithm list, the second-step audience check, the key-id read and the key loaded from a file. On the clean verifier it answered exactly No findings."},"note":"Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us in Node with the jsonwebtoken library; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. The rule that an expiry check must not be switched off is the skill's own policy, because the standards do not demand an exp claim. Facts come from RFC 8725 and RFC 7519, read on 26 October 2026; there are no owner-measured facts.","report_url":null},"price_usd":"0.01","price_micro":10000,"size_bytes":6744,"sha256":"967be5e2a06a5c53c47da242fb85f9d642172679eb56a347fa08d4ffa53fc42b","outline":["What the standards say, as published on 26 October 2026","The answer","The codes","Rules","Work in this order","Short example"],"license":{"summary":"Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing","holder":"Georgi Kalchev, aiskills402.com","url":"https://aiskills402.com/docs#license"},"buy_url":"https://api.aiskills402.com/v1/skills/jwt-verification-review/file","redownload_url_template":"https://api.aiskills402.com/v1/purchases/{token}","mcp_tool":null,"payment":{"protocol":"x402","scheme":"exact","asset":"USDC","selling":true,"network":"base","network_caip2":"eip155:8453","pay_to":"0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4","facilitator":"cdp"},"seo_title":"JWT Verification Review for Forged Tokens","seo_description":"Reviews one JWT verification module for header-chosen algorithms, ignored expiry, unchecked audience, decode misuse and keys in code. Pay $0.01 once, in USDC.","versions":[{"version":"1.0.0","date":"2026-10-26","changelog":"# Changelog\n\n## 1.0.0 — 2026-10-26\n\nFirst release, written in the light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description.\n\nTest: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.\n\nOne wording change after the runs: the reason on the last line of the short example was reworded so that no sentence of SKILL.md repeats in the public example; rules and codes are unchanged, no re-run.\n"}]}