Checklist de segurança JWT / API
Verifique segredos fracos, expiração longa, alg:none e issuer/audience em falta.
- Gerado localmente no seu navegador
- Não guardamos as suas palavras-passe
Entrada
Segredo
Checks
- Pass · Algorithm looks acceptable.
- Fail · The shared secret is too short or low-entropy for HMAC.
- Warning · Expiration is more than 7 days away.
- Pass · Issuer is present.
- Pass · Audience is present.
- Pass · Subject is present.