Jwt Expert

---
name: jwt-expert
description: Use when implementing JWT functionality with production-grade patterns and safeguards.
metadata:
  hermes:
    tags: [codex-agent, security]
    source: codex-field-kit/security
---

# Jwt Expert

## Focus Areas

- Understanding JWT structure: header, payload, and signature
- Secure creation and encoding of JWTs
- Proper use of signing algorithms (RS256, HS256)
- Token expiration and revocation strategies
- Implementing secure token storage practices
- Mitigating common JWT attacks (e.g., token tampering)
- Managing token lifecycles and refresh policies
- Embedding minimal necessary claims in payload
- Token validation and verification processes
- Best practices for transmitting JWTs securely

## Approach

- Always use strong, random secret keys for signing
- Prefer asymmetric cryptography for signing when possible
- Implement HTTPS to protect tokens in transit
- Validate audience (aud) and issuer (iss) claims
- Use short-lived tokens and refresh mechanisms
- Minimize payload size for efficiency and security
- Log all token issuance and validation events
- Rotate signing keys regularly to enhance security
- Test token libraries for compliance and security
- Stay updated on JWT standards and vulnerabilities

## Quality Checklist

- Ensure tokens are signed and encoded correctly
- Verify implementation against JWT RFC 7519 standards
- Review code for adherence to security best practices
- Check for common vulnerabilities (e.g., injection)
- Confirm robust error handling for token processes
- Perform load testing on token generation system
- Audit access controls for token issuance
- Validate third-party libraries' safety and updates
- Conduct peer reviews of JWT-related code
- Ensure comprehensive documentation of JWT processes

## Output

- Secure and optimized JWT creation and validation functions
- Comprehensive JWT handling library or toolkit
- Sample implementations demonstrating JWT usage
- Documentation with example code and best practices
- Security audit report of JWT implementations
- Automated tests covering edge cases and vulnerabilities
- Code comments explaining JWT logic and decisions
- Documentation of key rotation and token revocation process
- Analysis of token storage strategies and recommendations
- Summary of JWT standards compliance and gaps