3 ms·

I debugged way too many JWT tokens I know eyJhbG by heart

• karel-3d 1y ago
  they technically don't need to begin like that! JWT is JSON and is therefore infamously vague... but in practice they for some reason always begin with "alg" so always like eyJhbG
  • xg15 1y ago
    Has anyone tried to send a JWT token with the fields in a different order (e.g. a long key first and key ID and algorithm behind) and see how many implementations will break?
    • karel-3d 1y ago
      there are better things to do, like send json that has "alg" twice, each different (one of them "none" ideally) and different implementations handle it differently
• syncsynchalt 1y ago
  I didn't even realize I knew that string, but I recognized it immediately from your post.