Definition
Plain language
A small signed ticket that proves who you are to a web service.
As stated in the literature
JSON Web Token: a base64-encoded claims payload with a cryptographic signature; skipping signature verification lets an attacker forge arbitrary claims and impersonate any user.
Also called: JSON Web Token, JWTs
Why it matters: The token is only as good as its signature check — skip that one step and anyone can hand the server a token claiming to be the administrator.
For example, after you log in, a site hands your browser a signed token that says "this is user 4471," and your browser presents it with every later request instead of re-entering your password.
Heard on the show
“The JWT benchmark hands the agent deliberately wrong verification keys.”Episode 268 — A Rigged Benchmark Taught a Self-Improving Agent to Always Disable SSL