JWT Payload: Forbidden Data You Should Never Include

JSON Web Token (JWT) is a widely used method for securely transmitting data between parties. While JWTs offer security through signing and encryption, the payload is often exposed when using JSON Web Signature (JWS) with common algorithms like HS256 or RS256. This means that sensitive data in the payload can be read if the token is intercepted. To mitigate security risks, it is crucial to avoid including certain types of data in the JWT payload.

Forbidden Data in JWT Payload

Here are some types of data that should never be included in a JWT payload:

1. User Passwords

Storing plaintext passwords in a JWT payload is a severe security risk. Even if hashed, passwords should never be included because they can be extracted if the JWT is exposed.

2. Sensitive Personal Identifiable Information (PII)

Avoid including personal data such as:

• Social Security Numbers (SSNs)
• Full names and addresses
• Credit card numbers
• Phone numbers

If any PII must be included, consider encrypting the payload rather than relying solely on signing.

3. Session Identifiers or API Keys

JWTs are often used for authentication, but embedding session IDs or API keys within the token can expose them to attackers. Instead, store such information securely on the server side.

4. Sensitive Business Data

Do not include proprietary or confidential business data, such as:

• Trade secrets
• Internal algorithms
• Financial reports

5. Database Identifiers (e.g., User IDs)

Including raw database IDs can lead to enumeration attacks where attackers iterate through possible values to extract user data. Instead, use opaque tokens or UUIDs.

6. JWT Expiration (exp) Far into the Future

Setting an expiration date (exp) too far into the future increases the risk of long-lived tokens being abused. Always use short-lived tokens and refresh them as needed.

7. Roles & Permissions in Public JWTs

If the JWT is being used in a public setting (such as browser storage), avoid storing role-based access control (RBAC) permissions within the payload, as this information can be tampered with.

Best Practices to Secure JWTs

• Use Short Expiry Times: Limit the lifespan of tokens to reduce exposure.

• Implement Refresh Tokens: Use refresh tokens to generate new access tokens without exposing sensitive data.

• Use Encrypted JWTs (JWE): When transmitting sensitive information, use JWT encryption instead of relying only on signing.

• Store Tokens Securely: Avoid storing JWTs in local storage; use HTTP-only cookies for enhanced security.

• Verify Token Signatures: Always validate JWTs on the server to prevent tampering.

Conclusion

JWTs are powerful tools for authentication and authorization, but improper use can lead to security vulnerabilities. By ensuring that forbidden data is never included in the payload, developers can enhance security and reduce risks associated with token exposure.