Jwt

Skill G1Joshi/Agent-Skills/skills/security/jwt

A comprehensive skill catalog for AI agents

Install

npx -y skills add G1Joshi/Agent-Skills --skill jwt

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

10 stars10 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

JSON Web Tokens for secure transmission. Use for authentication.

SKILL.md

2.5 KB, as published. Nobody here has run it

JSON Web Token (JWT)

JWT is a compact, URL-safe means of representing claims to be transferred between two parties. The claims are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) or JSON Web Encryption (JWE).

When to Use

Stateless Authentication: API doesn't need to check a database session for every request.
Information Exchange: Securely transmitting information (like User ID + Roles) between microservices.

Quick Start (Structure)

Header.Payload.Signature

// Header
{
  "alg": "RS256",
  "typ": "JWT"
}

// Payload (Claims)
{
  "sub": "1234567890", // Subject (User ID)
  "name": "John Doe",
  "iat": 1516239022,    // Issued At
  "exp": 1516242622,    // Expiration
  "role": "admin"
}

// Signature
HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret)

Core Concepts

Signing Algorithms

HS256 (HMAC): Shared secret. Fast, simple. Good for internal microservices.
RS256 / ES256 (RSA/ECDSA): Public/Private key pair. The ID Provider signs with Private; APIs verify with Public. Preferred for 2025.

Claims

Registered: iss (issuer), exp (expiration), sub (subject), aud (audience).
Public/Private: Custom data (role, tenant_id).

Best Practices (2025)

Do:

Short Expiration: 5-15 minutes max. Use Refresh Tokens for long-lived sessions.
Algorithm Verification: Hardcode the expected algorithm (e.g., algorithms=['RS256']) in your verifier to prevent None alg attacks.
Use RS256/ES256: Avoid sharing secrets if possible.

Don't:

No PII: Don't put GDPR/PII data (email, address) in the JWT unless encrypted (JWE). It can be decoded by anyone.
No Sensitive Data: Don't put "password" or "credit card" in claims.
Don't store in LocalStorage: Susceptible to XSS. Use HttpOnly / Secure Cookies.

Troubleshooting

Error	Cause	Solution
`TokenExpiredError`	`exp` time passed.	Refresh the token using a Refresh Token.
`JsonWebTokenError`	Malformed or Signature mismatch.	Check secret/public key and token integrity.

Jwt