Audit of 12 Open-Source JWT Implementations Reveals 6 Repeated Security Flaws

A developer audited 12 open-source Node.js projects on GitHub last month and found the same six JWT security mistakes recurring across nearly all of them, including in widely used production boilerplates. The most critical errors included using weak hardcoded secrets like 'secret', calling jwt.decode() instead of jwt.verify() in authentication middleware, and omitting the algorithms option that guards against the 'alg: none' exploit. Several projects also committed JWT secrets directly to public repositories, where they remain exposed in git history even after file deletion. Other common issues were storing tokens in localStorage — which is vulnerable to XSS-based theft — and signing tokens without an expiry, leaving them valid indefinitely if leaked. The author recommends a checklist covering cryptographically random secrets, environment variable storage, explicit algorithm pinning, expiry settings, and the use of httpOnly cookies for token storage.