COSESAI

JWT Inspector & Verifier Field Guide: When Decoding Is Not Verifying

By xiezixing 2026年8月28日

Decode, verify, and rehearse the algorithm-confusion attack on JWTs. The seven claims that decide whether your verifier admits or rejects a token.

未分类

Base64URL Encoder Field Guide: When Three Characters Flip and Your JWT Survives URL Parsing

By xiezixing 2026年8月24日

A field guide to the URL-safe Base64 variant that powers JWT, JWS, and JWE — the three-character substitution that lets tokens survive URL parsing, the four operations in the encoder, the four edge cases that catch first-time auditors, and a six-tool companion pipeline for JWT debugging.

未分类

Your JWT Verifier Passed a Forged Token. The Library Did Exactly What It Was Told.

By xiezixing 2026年7月29日

Algorithm confusion is the most common JWT verifier failure in production. Pin the alg, pin the iss, pin the aud — then verify the signature.

Base64URL Encoder Decoder poster dark with cyan accent

未分类

Why Your JWT Breaks in URLs: The Base64URL Mistake 9 in 10 Engineers Ship

By xiezixing 2026年7月23日

Base64URL is not Base64 — and the difference breaks a JWT every time it travels through a URL. Here is the alphabet, the two-line fix, and the three workflows that catch the wrong encoding.