Analysis and mitigation of JWT and OAuth 2.0 vulnerabilities in REST APIs
TL;DR
A training and testing platform based on FastAPI was developed, featuring a fully manual implementation of JWT and OAuth 2.0 without the use of third-party libraries, showing that all six identified critical vulnerabilities were successfully reproduced in a vulnerable configuration and completely mitigated after applying the corresponding security controls.
Abstract
Modern web and mobile applications widely use JSON Web Tokens (JWT) and the OAuth 2.0 protocol for user authentication. However, implementation flaws remain one of the most common causes of account compromise. This paper investigates typical vulnerabilities in authentication mechanisms based on JWT and OAuth 2.0, including alg=none, algorithm confusion, the use of weak secret keys, the absence of token expiration validation (exp/iat), role forgery, and the lack of mandatory implementation of the Proof Key for Code Exchange (PKCE) mechanism in the Authorization Code Flow. To enable practical analysis and demonstration of these vulnerabilities, a training and testing platform based on FastAPI was developed, featuring a fully manual implementation of JWT and OAuth 2.0 without the use of third-party libraries. The platform includes both vulnerable and secure server implementations, allowing clear demonstration of attack exploitation mechanisms and the effectiveness of security measures in a controlled environment. The results show that all six identified critical vulnerabilities were successfully reproduced in a vulnerable configuration and completely mitigated after applying the corresponding security controls. The developed platform can be used as an effective educational tool for students and developers to gain practical experience in securing authentication mechanisms.