JWT Decoding·6 min read·2026-02-08T14:00:00Z

JWT Header Explained: alg, typ, kid, and Header Security Vulnerabilities

The JWT header provides cryptographic metadata instructing the recipient how to parse and verify the token. However, treating header claims as trusted input before signature verification has caused some of the most infamous security vulnerabilities in web history.

Standard Header Parameters (RFC 7515)

• **alg (Algorithm)**: Mandatory. Identifies the cryptographic algorithm (e.g. `HS256`, `RS256`, `ES256`). • **typ (Type)**: Declares the media type, typically `"JWT"`. • **kid (Key ID)**: Hints which key in a key store was used to sign the token. Crucial for key rotation. • **crit (Critical)**: Array of header extensions that the recipient must understand to accept the token.

Frequently Asked Questions

What is a SQL injection vulnerability via kid?

If a backend uses the "kid" header parameter directly in a database query to look up the signing key without parameterization, attackers can inject SQL payloads into the kid parameter.

JWT Header Explained – alg, typ, kid & Vulnerability Prevention | مولد مفتاح JWT السري | JWT Secret Key Generator