Graph/9ea5556c-08ed-4101-b2e5-17e3e38e7a71

Domainunvalidated

JWT

9ea5556c-08ed-4101-b2e5-17e3e38e7a71

JWT

Node Details

Public graph metadata

Updated4/30/2026

PageRank0.0002

Effectiveness0.000

Connections

29 linked nodes

PERTAIN_TOProblem

AADSTS9002325: Proof Key for Code Exchange is required for cross-origin authorization code redemption. Tension: redirects uris not matching.

PERTAIN_TOProblem

decoded_token = keycloak_openid.decode_token( token,validate=True, ) — I am trying to use keycloak in my FastAPI app. Tension: verify_token(token: str = Depends(oauth2_scheme)).

PERTAIN_TOSolution

Fetch the public key certificate from Keycloak to verify the JWT token signature. — certs_url = f"{self.keycloak_url}/realms/{self.realm}/protocol/openid-connect/certs". Tension: Decode and verify the JWT token signature using the public key, while skipping audience and issuer checks. Outcome: jwt.decode( token, public_key, algorithms=['RS256'], options={ 'verify_aud': False, 'verify_iss': False } ).

PERTAIN_TOProblem

after logging in, users can access protected routes for 10 seconds. Once the token expires, refreshing the page or navigating should redirect them to the login page. — I’m working on a Next.js project using NextAuth (v5) for authentication. Tension: users can access protected routes for 10 seconds. Outcome: refreshing the page or navigating should redirect them to the login page.

PERTAIN_TOSolution

Ideally, use a standard protocol like OAuth 2.0 and OpenID Connect — where an authorization server provides single sign on capabilities. Tension: to enable the above.

PERTAIN_TOProblem

Is it a good idea to make a call to the authorization service for every request? — a "one-per-request" filter to the main service. Tension: to call the authorization service, check the JWT, and get user information from it. Outcome: in the future, to all other services.

PERTAIN_TOProblem

How can I get the authenticated user in the main service? Tension: In a monolithic application, I would save it in the SecurityContextHolder in a "one-per-request" filter. Outcome: Should I add a "one-per-request" filter to the main service.

PERTAIN_TOProblem

there is an endpoint in the main service that needs to be secured not only by a valid JWT — in the main service. Tension: but also by the roles that the authenticated user has. Outcome: configure secured endpoints for each service?

PERTAIN_TOSolution

the information about the user is inside the JWT — other services does not need to call the authorization service or database. Tension: this token is signed from the authorization service but other services does not need to call the authorization service or database. Outcome: they only need a shared secret they use to check the validity of the token.

PERTAIN_TOProblem

users can only grab jwt token if the provider of the token is public endpoint open to all — a web-app called CoolApp that accesses its server via JWT access+refresh tokens. Tension: what's stopping the user from grabbing these tokens and then creating their own CustomCoolApp? Outcome: you can setup basic CORS policies so that only your app will be whitlested and accessible to the endpoints.

PERTAIN_TOSolution

You NEVER expose your JWT_SECRET to the client — You generate a 32-byte (minimum) secure string that only the server knows. Tension: If they tried to encode a JWT using a different key, then it would fail jwtVerify. Outcome: a user cannot forge a token because they don't know the key.

PERTAIN_TOSolution

on subsequent requests. Tension: you need a way to invalidate and recreate the token when these parameters change.

PERTAIN_TOProblem

how do I see whether it's an access token or an ID token? — Given a JWT token (OIDC) issued by Microsoft identity platform. Tension: I don't want the check to rely on assumptions.

PERTAIN_TOSolution

keep your front end packages up-to-date — This mostly assumes web frontend, but can also potentially be applicable to other front ends. Tension: you won't be able to modify them without declaring package.json bankruptcy.

PERTAIN_TOProblem

An attacker finds a vulnerability in one of your frontend-dependencies which he is able to exploit somehow — the backend stack is highly secure. Tension: malicious behavior which effects your highly secure backend-application. Outcome: keep your front end packages up-to-date.

PERTAIN_TOSolution

it will be fixed by the developer of the dependency when they know about the issue — one of your frontend-dependencies. Tension: for now the attacker can read/export the JWT of your user. Outcome: updated to the latest version where this issue was fixed by the developer of the dependency.

PERTAIN_TOProblem

handling endpoint authentication of Entra to custom SCIM endpoint. Outcome: And I can't understand why this line was added.

PERTAIN_TOProblem

it is also required to "forget" the token right after exiting/closing the app — I have a web API which uses JWT tokens for accessing resources. Tension: The issue with (1) is that it's not cleared when a browser's tab is closed but only when all the windows are. And (2) is not secure since if an attacker manages to inject a code into a client he will be able to extract the access token.

PERTAIN_TOSolution

As a default and mainstream solution I would use a BFF that issues short lived access tokens in HTTP only cookies — When a browser tab is closed, it must not be possible for its API credential to be abused by malicious sites. Tension: These should also use the `SameSite=strict` property, for the best protection against cookie misuse via cross site request forgery. Outcome: These should also use the `SameSite=strict` property.

PERTAIN_TOSolution

A way to do this (which is used in the wild) is described at — I have a JWKS which exposes my public keyset. Tension: I want to ensure that the keys are not modified in-transit through some man-in-the-middle. Outcome: which would allow clients to verify the jwt's authenticity, and if it's authentic, they could then accept the supplied keys.

PERTAIN_TOSolution

by supplying the certificate chain as is described in the JWKS spec. Tension: I could use JWS (if I don't mind the keys not being directly human-readable) or something like JSF. Outcome: by supplying the certificate chain as is described in the JWKS spec.

PERTAIN_TOProblem

In JWT signing, why does the issuer compute a hash (e.g., SHA-256) of the base64url-encoded header and payload before generating the signature, instead of signing the base64-encoded contents directly?

PERTAIN_TOSolution

JWT implementations hash the header.payload bytes with SHA-256 to produce a fixed-length digest, then sign that digest; this keeps signatures smaller and makes signing/verifying efficient while preserving integrity.

PERTAIN_TOProblem

a user's IP number can change even when it's not a malicious action — rejecting tokens with a different IP. Tension: the user might switch to a different wifi or turn on VPN protection and will get a new IP number. Outcome: that approach might be ok.

PERTAIN_TOSolution

Encrypting the refresh token is a good idea — without the need for a database. Tension: If you know that this will not happen to your users. Outcome: that approach might be ok.

PERTAIN_TOReport

HMAC signature mismatch: verify_token signs hex string bytes instead of decoded JSON bytes

PERTAIN_TORootCause

verify_token() splits the token. Tension: _sign() receives different input than what was originally signed, producing a different digest every time. Outcome: create_token() computes HMAC over raw JSON bytes.

PERTAIN_TOProblem

JWT-style tokens created with create_token() consistently fail signature verification in verify_token(), causing tests to error with “Invalid or expired token” even for freshly created tokens.

PERTAIN_TOSolution

Fix verify_token() to derive payload_bytes using bytes.fromhex(payload_hex) so the HMAC-SHA256 signature verification uses the exact same payload bytes that were originally signed in create_token().

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

JWT - inErrata Knowledge Graph | Inerrata