What it does. Implements secure JWT (RFC 7519) signing and verification using HMAC-SHA256, RSA-PSS, ES256, and EdDSA, including token expiration, claims validation, and defenses against algorithm-confusion, none-algorithm, and key-injection attacks. Use when adding or hardening JWT-based authentication/authorization, or when auditing token verification code for common JWT vulnerabilities. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-jwt-signing-and-verification, or copy the skill folder into ~/.claude/skills/implementing-jwt-signing-and-verification/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-jwt-signing-and-verification/SKILL.md

SKILL.md (verbatim)

name: implementing-jwt-signing-and-verification
description: >-
  Implements secure JWT (RFC 7519) signing and verification using HMAC-SHA256,
  RSA-PSS, ES256, and EdDSA, including token expiration, claims validation, and
  defenses against algorithm-confusion, none-algorithm, and key-injection
  attacks. Use when adding or hardening JWT-based authentication/authorization,
  or when auditing token verification code for common JWT vulnerabilities.
domain: cybersecurity
subdomain: cryptography
tags:
- cryptography
- jwt
- authentication
- token-security
- digital-signatures
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.DS-01
- PR.DS-02
- PR.DS-10
mitre_attack:
- T1600
- T1573
- T1553

Implementing JWT Signing and Verification

Overview

JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization in web applications. This skill covers implementing secure JWT signing with HMAC-SHA256, RSA-PSS, and EdDSA algorithms, along with verification, token expiration, claims validation, and defense against common JWT attacks (algorithm confusion, none algorithm, key injection).

When to Use

• When deploying or configuring implementing jwt signing and verification capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Familiarity with cryptography concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Objectives

• Implement JWT signing with HS256, RS256, ES256, and EdDSA
• Verify JWT signatures and validate standard claims
• Implement token expiration, not-before, and audience validation
• Defend against algorithm confusion and none algorithm attacks
• Implement JWT key rotation with JWK Sets
• Build a complete authentication middleware

Key Concepts

JWT Algorithms

Common JWT Attacks

• Algorithm confusion: Switching from RS256 to HS256, using public key as HMAC secret
• None algorithm: Setting alg=none to bypass signature verification
• Key injection: Embedding key in JWK header
• Weak secrets: Brute-forcing short HMAC secrets
• Token replay: Reusing valid tokens without expiration

Security Considerations

• Always validate the algorithm header against an allowlist
• Never accept alg=none in production
• Use asymmetric algorithms (RS256, ES256) for distributed systems
• Set short expiration times (15 min for access tokens)
• Implement token refresh mechanism
• Store secrets securely (not in source code)

Validation Criteria

• JWT signing produces valid tokens for all algorithms
• Signature verification rejects tampered tokens
• Expired tokens are rejected
• Algorithm confusion attack is prevented
• None algorithm is rejected
• JWK key rotation works correctly
• Claims validation enforces all required claims

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

JWT Implementation Template

Algorithm Selection Guide

JWT Claims Checklist

• sub - Subject (user ID)
• iss - Issuer (your app identifier)
• aud - Audience (intended recipient)
• exp - Expiration (short-lived: 15 min access, 7 day refresh)
• nbf - Not before (prevents premature use)
• iat - Issued at (token creation time)
• jti - JWT ID (unique, for revocation)

Security Checklist

• Algorithm allowlist enforced (never accept unknown alg)
• alg: none explicitly rejected
• Short expiration (access: 15 min, refresh: 7 days)
• Issuer and audience validation enabled
• Secrets >= 256 bits for HMAC algorithms
• RSA keys >= 2048 bits
• Tokens stored securely on client (httpOnly cookies preferred)
• Token refresh mechanism implemented
• Token revocation mechanism available (blacklist/JTI check)

references/api-reference.md (verbatim)

API Reference: Implementing JWT Signing and Verification

PyJWT Library

import jwt
# Sign with HS256
token = jwt.encode({"sub": "user1", "exp": time.time() + 3600}, "secret", algorithm="HS256")
# Verify
payload = jwt.decode(token, "secret", algorithms=["HS256"])
# Sign with RS256
token = jwt.encode(payload, private_key, algorithm="RS256")
payload = jwt.decode(token, public_key, algorithms=["RS256"])

JWT Algorithms

Standard JWT Claims (RFC 7519)

Common JWT Attacks

References

• RFC 7519 (JWT): https://datatracker.ietf.org/doc/html/rfc7519
• PyJWT: https://pyjwt.readthedocs.io/
• jose (JavaScript): https://github.com/panva/jose
• JWT.io Debugger: https://jwt.io/

references/standards.md (verbatim)

Standards and References - JWT Signing and Verification

Primary Standards

RFC 7519 - JSON Web Token (JWT)

• URL: https://www.rfc-editor.org/rfc/rfc7519
• Description: JWT format and claims specification

RFC 7515 - JSON Web Signature (JWS)

• URL: https://www.rfc-editor.org/rfc/rfc7515
• Description: Signature mechanism for JWTs

RFC 7517 - JSON Web Key (JWK)

• URL: https://www.rfc-editor.org/rfc/rfc7517
• Description: Key format for JWT signing keys

RFC 7518 - JSON Web Algorithms (JWA)

• URL: https://www.rfc-editor.org/rfc/rfc7518
• Description: Cryptographic algorithms for JWS/JWE

RFC 8725 - JWT Best Current Practices

• URL: https://www.rfc-editor.org/rfc/rfc8725
• Description: Security best practices for JWT implementations

OWASP References

OWASP JWT Cheat Sheet

• URL: https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html

Python Libraries

PyJWT

• URL: https://pyjwt.readthedocs.io/
• PyPI: https://pypi.org/project/PyJWT/

python-jose

• URL: https://python-jose.readthedocs.io/
• PyPI: https://pypi.org/project/python-jose/

references/workflows.md (verbatim)

Workflows - JWT Signing and Verification

Workflow 1: Token Issuance

[Authentication Request] (username + password)
      |
[Validate Credentials]
      |
[Build JWT Claims]:
  - sub: user ID
  - iss: issuer URL
  - aud: audience
  - exp: expiration (now + 15 min)
  - iat: issued at
  - jti: unique token ID
      |
[Sign with Private Key / Secret]
(RS256 / ES256 / HS256)
      |
[Return: access_token + refresh_token]

Workflow 2: Token Verification

[Incoming Request with Bearer Token]
      |
[Extract Token from Authorization Header]
      |
[Decode Header (without verification)]
[Check alg against allowlist]
      |
[Verify Signature]
(using public key / shared secret)
      |
[Validate Claims]:
  - exp: not expired
  - nbf: not before current time
  - iss: expected issuer
  - aud: expected audience
      |
[Accept / Reject Request]

Workflow 3: Key Rotation

[Generate New Signing Key]
      |
[Add to JWK Set with unique kid]
      |
[Update /.well-known/jwks.json]
(new key + old key)
      |
[New tokens signed with new key]
[Old tokens still verify with old key]
      |
[After grace period: remove old key]

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.