JWT Lab — Decode and Verify
Decode, forge-reject, expiry-deny on 127.0.0.1:8813 —.
Visual · jwt_lab_decode_verify
Lab: structure, verify, claims. Bind 127.0.0.1:8813.
Three proofs: you can read claims, you cannot authorize with a forge when verify is on, expiry bites.
Lessons 1–3 covered structure, alg/verify, and claims hygiene. This lab ships transcripts from 127.0.0.1:8813: decode a valid lab JWT, show a tampered/unsigned token fail, show an expired token fail. No phishing, no stranger targets, no 0.0.0.0. Next: Quiz — JWT Pitfalls.
1. Lab contract
. STOP if router. Start JWT toy on 127.0.0.1:8813. Use only course lab secrets.
Prepare three tokens or modes: valid, tampered/unsigned, expired — as the toy documents.
Command guide
Try these commands — Lab contract
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Auth0 JWT validation — https://auth0.com/docs/secure/tokens/json-web-tokens/validate-json-web-tokens RFC 7519 — https://www.rfc-editor.org/rfc/rfc7519
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3 sudo apt install jq
macOS:
Command — copy this
brew install python3 brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS -X POST http://127.0.0.1:8813/token -H "Content-Type: application/json" -d '{"user":"lab","pass":"lab"}' 2>/dev/null | jq -r '.access_token // empty' | head -c 40; echo
curl -sS -H "Authorization: Bearer lab-signed-jwt" http://127.0.0.1:8813/me 2>/dev/null | jq . || curl -sS -H "Authorization: Bearer lab-signed-jwt" http://127.0.0.1:8813/me
python3 -c "import base64,json; print(json.loads(base64.urlsafe_b64decode('eyJzdWIiOiJsYWIifQ=='+'=')))"Primary tools to practice this lesson: curl, python3, jq. Reference sites: Auth0 JWT validation (https://auth0.com/docs/secure/tokens/json-web-tokens/validate-json-web-tokens); RFC 7519 (https://www.rfc-editor.org/rfc/rfc7519). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Run decode and verify evidence
Decode valid payload locally. curl privileged route with valid token (success), tampered (fail), expired (fail). Save statuses.
Write encode≠encrypt and verify-before-claims in the lab note.
3. Cleanup
Stop pid. chmod 600. Do not upload lab tokens to public gists. Confirm no OAuth phishing kit residue.
Quiz next.
4. What you ship: valid / tampered / expired evidence on YOUR lab
Three statuses recorded. Bind 127.0.0.1:8813. DEMO GATE. No stranger forgery. No 0.0.0.0.
5. What you record before the next lesson
Date. valid/tampered/expired results. File t13-m04-l04-jwt-lab.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Attack a public JWT API. Crack production HS256. Host phishing for id_tokens.
- Right: Loopback evidence only. Next: Quiz — JWT Pitfalls.
Mission: JWT literacy with three outcomes
1) / STOP if router. 2) On 127.0.0.1:8813 show valid success, tampered fail, expired fail. 3) chmod 600 notes. Never forge against unowned hosts.
Stuck? Ask Cyberlium AI Mentor
If all tokens fail, check the toy’s expected alg and secret — do not pivot to a live site.
APPLY: Tampered payload with verify on should:
APPLY: True or False: 0.0.0.0 bind is required for JWT labs.
APPLY: Public jwt.io with a real customer token is: