JWT Asymmetric RS256/ES256 Signature Hardening

---
name: "jwt-rs256-signature-hardening"
description: "Harden JSON Web Tokens with asymmetric key verification and strict claim validation."
metadata:
  author: "Auth0"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "verify jwt with rs256"
  - "prevent jwt algorithm confusion"
  - "validate jwt exp and iss claims"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# JWT Asymmetric RS256/ES256 Signature Hardening

Enforces secure JWT handling: banning 'none' algorithm, rejecting HS256/RS256 algorithm confusion, validating asymmetric signatures via JWKS public keys, and verifying iss, aud, and exp claims.

## When to Invoke
Invoke this skill whenever you need to:
- verify jwt with rs256
- prevent jwt algorithm confusion
- validate jwt exp and iss claims

## Execution SOP & Rules
1. Explicitly whitelist allowed algorithms in verification options: algorithms: ['RS256', 'ES256'].
2. Never permit the 'none' algorithm under any circumstances.
3. Fetch public keys from trusted JWKS endpoints and cache with appropriate key rotation TTLs.
4. Enforce strict expiration checks with a maximum allowable clock skew of 60 seconds.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.