Checklist de seguridad JWT / API
Comprueba secretos débiles, expiración larga, alg:none e issuer/audience faltantes.
- Generado localmente en tu navegador
- No almacenamos tus contraseñas
Entrada
Secreto
Checks
- Pass · Algorithm looks acceptable.
- Fail · The shared secret is too short or low-entropy for HMAC.
- Warning · Expiration is more than 7 days away.
- Pass · Issuer is present.
- Pass · Audience is present.
- Pass · Subject is present.