I Audited 12 Open Source JWT Implementations and Found the Same 6 Mistakes

Short summary

An audit of 12 open-source Node.js JWT implementations found six recurring mistakes: hardcoded weak secrets, using jwt.decode() instead of jwt.verify(), missing algorithm whitelisting, committed secrets in public repos, tokens stored in localStorage vulnerable to XSS, and missing expiration claims. Each mistake includes a concrete fix and a pre-production checklist.

• •Hardcoded 'secret' from tutorials has ~42 bits of entropy — crackable in milliseconds; use a CSPRNG-generated 256-bit key
• •jwt.decode() doesn't verify signatures — always use jwt.verify() with explicit algorithms option
• •Store tokens in httpOnly cookies, not localStorage; always set expiresIn on access tokens

Generated with AI, which can make mistakes.