Security Test: JWT contains sensitive data¶

Scanner(s) Support¶

Description¶

Default Severity: medium

JWTs (JSON Web Tokens) should not contain sensitive information in their payload as they are only base64 encoded and can be easily decoded by anyone. Storing sensitive data like passwords, personal information, or secrets in JWT claims can lead to data breaches and privacy violations.

Configuration¶

Identifier: information_disclosure/jwt_sensitive_data

Examples¶

All configuration available:

checks:
  information_disclosure/jwt_sensitive_data:
    skip: false # default

Compliance and Standards¶