Protecting APIs with JWT Validation
Mar 5, 2024John Cosgrove
Summary
This post announces the General Availability (GA) of JWT validation in Cloudflare's API Gateway. It details the improvements made since the beta release, including support for Bearer token format, multiple JWKS configurations, validation of JWTs in cookies, and the ability to exclude managed endpoints. The post also explains the threat of broken authentication and authorization, provides a primer on JWT structure and its security benefits, and illustrates how JWT validation protects against missing/broken authentication and expired token reuse.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack