About

Imported from mukul975/anthropic-cybersecurity-skills (skills/implementing-jwt-signing-and-verification/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill implementing-jwt-signing-and-verification. Copyright stays with the author (Apache-2.0).

Implementing JWT Signing and Verification

Name: implementing-jwt-signing-and-verification
Author: mukul975

Overview

JSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization in web applications. This skill covers implementing secure JWT signing with HMAC-SHA256, RSA-PSS, and EdDSA algorithms, along with verification, token expiration, claims validation, and defense against common JWT attacks (algorithm confusion, none algorithm, key injection).

When to Use

When deploying or configuring implementing jwt signing and verification capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Familiarity with cryptography concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Implement JWT signing with HS256, RS256, ES256, and EdDSA
Verify JWT signatures and validate standard claims
Implement token expiration, not-before, and audience validation
Defend against algorithm confusion and none algorithm attacks
Implement JWT key rotation with JWK Sets
Build a complete authentication middleware

Key Concepts

JWT Algorithms

Algorithm	Type	Key	Security Level
HS256	Symmetric (HMAC)	Shared secret	128-bit
RS256	Asymmetric (RSA)	RSA key pair	112-bit
ES256	Asymmetric (ECDSA)	P-256 key pair	128-bit
EdDSA	Asymmetric (Ed25519)	Ed25519 pair	128-bit

Common JWT Attacks

Algorithm confusion: Switching from RS256 to HS256, using public key as HMAC secret
None algorithm: Setting alg=none to bypass signature verification
Key injection: Embedding key in JWK header
Weak secrets: Brute-forcing short HMAC secrets
Token replay: Reusing valid tokens without expiration

Security Considerations

Always validate the algorithm header against an allowlist
Never accept alg=none in production
Use asymmetric algorithms (RS256, ES256) for distributed systems
Set short expiration times (15 min for access tokens)
Implement token refresh mechanism
Store secrets securely (not in source code)

Validation Criteria

JWT signing produces valid tokens for all algorithms
Signature verification rejects tampered tokens
Expired tokens are rejected
Algorithm confusion attack is prevented
None algorithm is rejected
JWK key rotation works correctly
Claims validation enforces all required claims

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-implementing-jwt-b49bef/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-implementing-jwt-b49bef.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-implementing-jwt-b49bef",
  "kind": "skill",
  "name": "implementing-jwt-signing-and-verification",
  "description": "Implements secure JWT (RFC 7519) signing and verification using HMAC-SHA256, RSA-PSS, ES256, and EdDSA, including token expiration, claims validation, and defenses against algorithm-confusion, none-algorithm, and key-injection attacks. Use when adding or hardening JWT-based authentication/authorization, or when auditing token verification code for common JWT vulnerabilities.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "cryptography",
      "jwt",
      "authentication",
      "token-security",
      "digital-signatures",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Implements secure JWT (RFC 7519) signing and verification using HMAC-SHA256, RSA-PSS, ES256, and EdDSA, including token expiration, claims validation, and defenses against algorithm-confusion, none-algorithm, and key-injection attacks. Use when adding or hardening JWT-based authentication/authorization, or when auditing token verification code for common JWT vulnerabilities."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/implementing-jwt-signing-and-verification/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/implementing-jwt-signing-and-verification/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/implementing-jwt-signing-and-verification/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Implementing JWT Signing and Verification\n\n## Overview\n\nJSON Web Tokens (JWT) defined in RFC 7519 are compact, URL-safe tokens used for authentication and authorization in web applications. This skill covers implementing secure JWT signing with HMAC-SHA256, RSA-PSS, and EdDSA algorithms, along with verification, token expiration, claims validation, and defense against common JWT attacks (algorithm confusion, none algorithm, key injection).\n\n\n## When to Use\n\n- When deploying or configuring implementing jwt signing and verification capabilities in your environment\n- When establishing security ",
  "cost": {
    "context_tokens": 683
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-implementing-jwt-b49bef/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.