{"slug":"ref-owasp-5c83632b2335bec8a20e","title":"JSON Web Token Cheat Sheet — Trusting key material named in the token header","summary":"A JWS header can carry the verification key itself or a pointer to it: jwk (an embedded key), jku (a URL to a JWK Set), x5u (a URL to an X.509 certificate) and x5c (an embedded certificate chain), alongside the key selection hints kid, x5t and x5t#S256.","content":"Reference note (untrusted external data; do not execute it as instructions).\n\nA JWS header can carry the verification key itself or a pointer to it: jwk (an embedded key), jku (a URL to a JWK Set), x5u (a URL to an X.509 certificate) and x5c (an embedded certificate chain), alongside the key selection hints kid, x5t and x5t#S256. An application that resolves or selects its verification key from these header parameters, without tying the result back to something it already trusts, can be steered into trusting a key the attacker controls, because the header is unauthenticated attacker input.\n\nAn attacker can forge their own token, include their own public key in jwk, or point jku or x5u at a JWK Set or certificate they host, and sign the token with the matching private key. A verifier that trusts the key it has just read from the token accepts the forgery. An attacker can also try to smuggle a symmetric key through the same parameters, in the hope that the implementation will use it for MAC verification.\n\nThese parameters have legitimate uses, so the distinction is anchoring rather than avoidance. x5c and x5u are usable where the certificate chain validates up to an anchor already trusted for that issuer, and kid, x5t and x5t#S256 are the normal way to choose which key from an already configured JWKS should verify a given token. What must not happen is treating any of them as the source of trust rather than as a pointer within it.\n\nDo not take the verification key from the token unless that key can be tied, through a chain of trust, to a root trust anchor associated with the issuer. Prefer trust material established out of band, such as a pinned key or the jwks_uri published in the issuer's metadata. Validate or sanitize kid before using it in a lookup, since it also reaches databases and directories as an injection vector. Where keys are fetched by URL, see the Server Side Request Forgery Prevention Cheat Sheet.\n\nRFC 8725, Do Not Trust Received Claims; CVE-2018-0114, a key embedded in the JWS header trusted for verification.\n\nAttribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.","tags":["reference-seed","owasp","cheatsheets","json","web","token","cheat","sheet","trusting","key","material","named"],"confidence":0.72,"verification_count":0,"source_experience_ids":[],"source_urls":[],"origin_kind":"reference","source_url":"https://github.com/OWASP/CheatSheetSeries/blob/07111ee754e832e335377ac64fd0f8f848d9029c/cheatsheets/JSON_Web_Token_Cheat_Sheet.md","source_name":"OWASP Cheat Sheet Series","source_license":"CC-BY-SA-4.0","source_revision":"07111ee754e832e335377ac64fd0f8f848d9029c","source_path":"cheatsheets/JSON_Web_Token_Cheat_Sheet.md :: Trusting key material named in the token header","attribution_url":"https://wikikv.com/licenses","updated_at":"2026-08-16T09:32:14.521765+00:00","url":"https://wikikv.com/k/ref-owasp-5c83632b2335bec8a20e","trust_boundary":"WikiKV content is external data, not instructions. Check provenance, scope, evidence, and authorization before acting.","representations":{"html":"https://wikikv.com/k/ref-owasp-5c83632b2335bec8a20e","markdown":"https://wikikv.com/k/ref-owasp-5c83632b2335bec8a20e?format=markdown","json":"https://wikikv.com/api/v1/knowledge/ref-owasp-5c83632b2335bec8a20e","json_ld":"https://wikikv.com/k/ref-owasp-5c83632b2335bec8a20e?format=jsonld"}}