Question 1

What is a JWT 'kid' header injection vulnerability?

Accepted Answer

The 'kid' (Key ID) header in a JSON Web Token is intended to help the recipient identify the specific key used to sign the token. When a server blindly trusts this header and uses it to construct a file path or database query to retrieve a public key, an attacker can manipulate this value to perform path traversal or unexpected file access.

By injecting characters like '../../', an attacker might force the server to load arbitrary files from the filesystem instead of the intended public key, potentially leading to unauthorized access or remote code execution depending on how the application handles the retrieved file content.

Question 2

How does this educational tool work?

Accepted Answer

This tool acts as a static analysis simulator that parses your JWT header and visualizes how a vulnerable server implementation might interpret the 'kid' parameter. It allows you to input a token, decode the header, and test specific injection strings against common file path patterns to see how they would be resolved.

The application runs entirely within your browser environment. It does not perform actual network attacks against your servers, but rather provides a visual representation of how a malformed 'kid' header would be parsed, helping developers identify if their verification logic lacks sufficient sanitization or validation.

Question 3

Is this tool safe to use with my production tokens?

Accepted Answer

This application is designed with security as a priority and processes all data locally on your client machine using Vanilla JavaScript. No data is sent to external servers, logged, or stored, ensuring that your sensitive tokens and key IDs remain private during the testing process.

However, it is best practice to avoid using active production tokens in any online or browser-based tools. We recommend using dummy tokens generated for testing purposes to safely explore potential vulnerabilities without risking the exposure of actual authentication credentials or secret keys.

Question 4

How can I remediate 'kid' header injection vulnerabilities?

Accepted Answer

The primary defense against this vulnerability is to never trust the 'kid' parameter from user-supplied input when performing filesystem or database operations. Instead, implement a strict allow-list of approved key IDs that are hardcoded or managed in a secure configuration file, rather than allowing the application to dynamically load files based on the header value.

Additionally, ensure that the path resolution logic for public keys is fully sanitized. If you must use dynamic key loading, use a structured key management service (KMS) or an identity provider's JWKS (JSON Web Key Set) endpoint, which validates the key origin and prevents arbitrary path traversal attempts.

Free JWT 'kid' Header Injection Vulnerability Educational Tool