what happens to a request inside nginx and Apache
How nginx and Apache select a site, process the path and forward a request to the application, and what you can test from the outside.
Posts
where HTTP actually breaks
How proxies and applications interpret the same request differently: body boundaries, paths, forwarding headers and cache keys.
Post-Quantum JWT and the Future of Tokens
The series finale. Shor's algorithm breaks every asymmetric JWT algorithm. ML-DSA signatures at 2.4 KB don't fit in a cookie. SD-JWT for selective disclosure. Harvest Now, Decrypt Later — why migrating JWE to post-quantum cryptography is needed now.
RFC 8725 - the checklist nobody reads
RFC 8725 — fifteen JWT security rules from the standard's authors. For each — which attack from the series it prevents, which CVEs exist, and why ~65% of applications don't check aud. Plus three new rules from the 2026 bis update.
What Instead of JWT - PASETO, Macaroons, Opaque Tokens, and Server-Side Sessions
JWT isn't perfect — 70+ CVEs over ten years. We break down the alternatives: PASETO without the alg field, Macaroons with unique attenuation, opaque tokens with instant revocation, Google/Netflix server-side sessions. For each — what to break on a pentest.
Hardcoded Secrets - When the Key Is Sitting in the Source Code
CVE-2025-20188 (CVSS 10.0): eight characters 'notfound' in a Cisco IOS XE Lua script = root RCE on enterprise equipment. 17% of JWT CVEs in 2024-2026 are hardcoded secrets. Where to look: git history, Docker layers, JS bundles, source maps, firmware.
Advanced Crypto Attacks - Lattices, Side-Channels, and Fault Injection
Leak three bits of the nonce from each ECDSA signature — and after 100 signatures you have the full private key. Minerva, TPM-FAIL, EUCLEAK: real attacks on real devices, and what's actually applicable on a web pentest right now.
XSS + JWT = Full Account Takeover
Found a Reflected XSS? If the app stores JWTs in localStorage, that's not just alert(1) — it's a full takeover of every account. We cover theft from every storage type, CSP bypass via WebRTC and CSS injection, and the only defenses that actually work.
JWT in OAuth 2.0 and OIDC - where it breaks in the real world
At the seams between OAuth and OIDC components, attacks emerge that don't exist in isolation: token confusion, cross-service relay, ALBeast in AWS, and DPoP bypass — with real CVEs and step-by-step pentest checks.
JWT Libraries - a Leakiness Ranking
Which library is running on the backend determines which attacks will actually land: a ranked breakdown of the most vulnerable JWT libraries, a tier classification from recommended to dangerous, and passive fingerprinting techniques that identify the stack from the token header alone.