Are you sure your access tokens are really secure? - Wesley Cabus - NDC Copenhagen 2025

Are you sure your access tokens are really secure? - Wesley Cabus - NDC Copenhagen 2025

by Wesley Cabus

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Wesley Cabus 👥 227K 📅 January 16, 2026 ⏱ 53 min 👁 4K 📄 expert opinion 🧭 2026-08-13
Available in: English (current) Français

Keywords

JWTaccess tokensecurityvalidationtesting

Summary

Wesley Cabus presents a security-focused talk at NDC Copenhagen 2025, addressing common pitfalls in JWT access token validation. He begins with a real-world story of an API that was compromised due to improper token validation, leading to data loss. The talk explains the structure of JWTs, including header, payload, and signature, and highlights two major attack vectors: algorithm confusion (using ’none’ algorithm) and self-signed tokens via embedded JWK or external references. The speaker demonstrates how these attacks can bypass validation if not properly configured. He emphasizes the importance of rigorous testing and introduces an open-source template called ‘Jotguard’ for integration testing JWT validation. The talk concludes with a bonus section on algorithm confusion attacks, where an attacker can sign a token with HS256 using the public key intended for RS256. The speaker provides practical advice on securing token validation and encourages developers to write tests to catch these vulnerabilities.

149 words

Critical Evaluation

Value of the Information & Strength of the Argument

The talk provides valuable insights into real-world JWT security vulnerabilities, illustrated with concrete examples and demonstrations. The speaker’s argumentation is solid, based on his experience and the incidents he describes. He effectively explains complex attack vectors in an accessible manner, making the content valuable for developers and security professionals. The emphasis on testing and the introduction of an open-source template add practical value, enabling attendees to apply the lessons learned.

79 words

Title / Content Match

The title accurately reflects the content, which focuses on the security of access tokens and potential validation bypasses.

Quality & Reliability

8/10

The talk is based on real-world security incidents and demonstrates concrete attack vectors with practical testing approaches. The speaker is a customer success engineer at Duende Software, a company known for identity server solutions, lending credibility. However, the presentation is largely anecdotal and lacks formal citations or peer-reviewed sources.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • NDC Conferences — Conference website
  • NDC Copenhagen — Conference website

Concurring Sources

  • RFC 7515 — Defines JWS, supporting the explanation of token structure and signature.
  • RFC 7517 — Defines JWK, relevant to the self-signed token attack.

Contribution & Novelties

The talk provides a practical, hands-on approach to testing JWT validation, addressing common but often overlooked vulnerabilities. The introduction of the open-source Jotguard template is a novel contribution, offering a reusable test suite for developers. The talk also highlights the importance of trust in open-source libraries and the need for continuous testing.

Pour aller plus loin :

  • RFC 7515 - JSON Web Signature — Official specification for JWS, relevant to the signature validation discussed.
  • RFC 7517 - JSON Web Key — Specification for JWK, central to the self-signed token attack.
  • OWASP JWT Cheat Sheet — Practical guidance on JWT security, including algorithm confusion prevention.

104 words

Radar Profile

The radar profile shows high scores in information quantity and quality, with a moderate technical level and reliability. This indicates a well-balanced presentation that is informative and credible, though not extremely technical or heavily sourced.

Reliability 7/10

💬 Sur les 0 commentaires analysés, aucune tendance n'est disponible.