Claims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so their integrity and freshness matter.
Claims are where authentication quietly becomes authorization, and where most token bugs live. A relying party that trusts a groups or roles claim without verifying the issuer, audience, and signature has an authorization system anyone can forge. Claim freshness is the second trap: a token minted before a user was removed from a group stays valid until it expires, which is why revocation needs short lifetimes or a continuous-evaluation signal.
See also: JWT, ID token, OpenID Connect, validate a JWT recipe
Related on Start with Identity
- GlossaryJWKS
JSON Web Key Set. A published set of public keys an issuer uses to sign tokens, letting relying parties verify JWT signatures and handle key rotation. The JWKS
- GlossaryOpenID Connect (OIDC)
OpenID Connect is an authentication layer built on top of OAuth 2.0. Where OAuth tells you what a token is authorized for, OIDC tells you who the user is via a
- GlossaryAccess Token
A short-lived credential a client presents to a resource server to access protected data. Access tokens are typically opaque or JWT-formatted, with lifetimes me
- CVEAuth0 node-jws HS256 verification bypass via secret lookup
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEICS JWT auth bypass via hard-coded constants
An industrial-control product accepted JWTs built from hard-coded constants (CWE-547). Critical authentication bypass. CISA ICSA-25-175-07.