JKU (JWK Set URL) Header Injection

The jku header parameter specifies a URL pointing to a JSON Web Key Set (JWKS) containing the public keys used to verify the token signature. If the server fetches keys from arbitrary URLs without enforcing a strict domain allowlist, an attacker can host their own jwks.json file and forge administrative tokens.

Sample Token (Guest)

This token references the server's public key set at https://authlab.digi.ninja/.well-known/jwks.json:

eyJhbGciOiJSUzI1NiIsImprdSI6Imh0dHBzOi8vYXV0aGxhYi5kaWdpLm5pbmphLy53ZWxsLWtub3duL2p3a3MuanNvbiIsImtpZCI6ImF1dGhsYWItamt1LWtleS0xIiwidHlwIjoiSldUIn0.eyJhZG1pbiI6ZmFsc2UsInVzZXIiOiJndWVzdCJ9.Jx2k6ItUNDHB1Dg1aRt0Xo18igF0DfpBjb51ToRLHcY4ZjtC9HO4Ig0m0TFujl5BVWsvkwUbDJEZmo5sFuwEp0RVz2EwpTgY3WbVlN3zYPsdGAo_rRjlHmgwlzfwCo725LqeCNuuc2PKzx7esPpVWI3PhkD8qGB-4Nj2AdrvujNV98HmkbzV5_SAAapEjN5WqGn7U5mwciyFCKlYRqbNvL6c8lUTw4ysaVn6FAgdd1rnxPwCWDUmDYTOptkkOi6FqfXvswHJOU_vCkAC6-u2zx9Ha6BMMqHv6Ns9oZN43n2ppLH-yZZgIQlG5KW4ZwJzZYVKrO-gqIcYb5ywZVuQNA

Submit Token

Back to home

Lab created by Robin Wood - DigiNinja