Tag See all →

#jwt

2 stories

Banner: CORS preflight request rejected by nginx after adding an Authorization header

Web Development Bug Report

CORS preflight fails after adding an Authorization header behind nginx

Daniel Tran · Feb 11, 2025 · 9 min read

Moving our SPA from cookie auth to bearer tokens broke every API call with a CORS error. The Authorization header triggered an OPTIONS preflight, our nginx auth check rejected it, and error responses carried no CORS headers.

Banner: JSON Web Token payload trusted without verifying its signature

Security Bug Report

JWT decoded but never verified: how our API trusted unsigned claims

Daniel Tran · Nov 12, 2024 · 9 min read

An internal reporting service read the user ID and role from a JWT with jwt.decode(), which never checks the signature. A route that bypassed our gateway let any edited token through. We switched to verification with a pinned algorithm, issuer, audience and JWKS rotation.