eslint-plugin-jwt-security

AI-Optimized Security

Every rule includes CWE, OWASP, and CVSS metadata for AI assistants to provide precise, context-aware fixes.

Install

npm install -D eslint-plugin-jwt-security

Rules (13)

Browse all JWT security rules with CWE/OWASP mapping

Changelog

View version history and updates

Live from GitHub

This content is fetched directly from README.md on GitHub and cached for 1 hour.

Live README from GitHubfrom eslint-plugin-jwt-security/README.md, cached for 1 hour.Edit on GitHub

⭐ If this plugin caught a real bug for you, star the repo — it's the signal that keeps these rules maintained.

Description

This plugin provides Security validation for JSON Web Tokens (JWT) implementation (signing, verification).

Why — a linter nobody reads protects nothing. We would rather miss a finding than spend your attention on one that was never real.
How — evidence, not names. A rule fires on what the code does, resolved through the AST and ESLint's own scope analysis.
What — every finding carries its fix, in prose for a human and as structured JSON for an agent. Security rules add a CWE mapping and, where assigned, a CVSS score.

That trade costs recall, and we measure it: methodology · results · a false positive is a bug.

Getting Started

To check out the guide, visit eslint.interlace.tools. 📚

npm install eslint-plugin-jwt-security --save-dev

⚙️ Configuration Presets

Preset	Description
`recommended`	Recommended preset - balanced security
`strict`	Strict preset - maximum security (includes 2025 research)
`legacy`	Legacy preset - migration mode
`all`	All rules preset

📚 Supported Libraries

Library	npm	Downloads	Detection
`jsonwebtoken`			Signing, Verification, Decoding
`jose`			Verification (Fix Suggestion)
`jwt-decode`			Unsafe Decoding

🤖 AI-Optimized Messages

Every rule uses formatLLMMessage for structured output:

🔒 CWE-347 OWASP:A02-Crypto CVSS:9.8 | Using alg:"none" bypasses signature verification
   Fix: Remove "none" and use RS256, ES256, or other secure algorithms
   https://nvd.nist.gov/vuln/detail/CVE-2022-23540

By providing this structured context (CWE, OWASP, Fix), we enable AI tools to reason about the security flaw rather than hallucinating. This allows Copilot/Cursor to suggest the exact correct fix immediately.

By structuring errors with specific CWE codes, OWASP categories, and direct fix suggestions, this format allows AI coding assistants to autonomously identify, explain, and resolve security vulnerabilities with high confidence.

💡 What You Get

13 Security Rules - Algorithm attacks, replay prevention, claim validation
6 JWT Libraries - jsonwebtoken, jose, express-jwt, @nestjs/jwt, jwks-rsa, jwt-decode
2025 Research - "Back to the Future" replay attack prevention (LightSEC 2025)
AI-Optimized - Structured messages for GitHub Copilot, Cursor, Claude assistance
CWE References - Every rule maps to Common Weakness Enumeration

📦 Compatibility

Package	Version
ESLint	`^8.40.0 \|\| ^9.0.0 \|\| ^10.0.0`
Node.js	`>=18.0.0`

See the ESLint Version Support Policy — current ecosystem share data, the 20% gate, and the forward-looking exception that covers v10.

Rules

Legend

Icon	Description
💼	Recommended: Included in the recommended preset.
⚠️	Warns: Set to warn in recommended preset.
🔧	Auto-fixable: Automatically fixable by the `--fix` CLI option.
💡	Suggestions: Providing code suggestions in IDE.
🚫	Deprecated: This rule is deprecated.
🟢	Type-unaware: AST-only, runs in oxlint JS-plugin tier.
🟡	Type-aware (refining): pure-AST primary path; types refine precision.
🟠	Type-aware (graceful): requires TS program; silent without it.

Rule	CWE	Description	🧠	💼	⚠️
no-algorithm-confusion	CWE-347	This rule detects algorithm confusion attacks where symmetric algorithms (HS256, HS384, HS512) are used wit…	🟢	💼
no-algorithm-none	CWE-347	This rule detects attempts to use the none algorithm which completely bypasses JWT signature verification	🟢	💼
no-decode-without-verify	CWE-345	The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:	🟢	💼
no-hardcoded-secret	CWE-798	The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:	🟢	💼
no-sensitive-payload	CWE-359	JWT payloads are NOT encrypted, only base64-encoded	🟢		⚠️
no-timestamp-manipulation	CWE-294	This rule detects noTimestamp: true which disables automatic iat (issued at) claim generation	🟢	💼
no-weak-secret	CWE-326	The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:	🟢	💼
require-algorithm-whitelist	CWE-757	This rule enforces explicit algorithm specification in verify() calls	🟢	💼
require-audience-validation	CWE-287	The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:	🟢
require-expiration	CWE-613	The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:	🟢	💼
require-issued-at	CWE-294	This rule ensures tokens have the iat claim for freshness validation	🟢
require-issuer-validation	CWE-287	The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:	🟢
require-max-age	CWE-294	This rule mandates maxAge in verify operations	🟢

Part of the Interlace ESLint ecosystem — AI-native rules with LLM-optimized error messages:

Security

Plugin	Downloads	Description
`eslint-plugin-anthropic-security`		Anthropic SDK security.
`eslint-plugin-browser-security`		XSS, DOM security.
`eslint-plugin-drizzle-security`		Drizzle security.
`eslint-plugin-express-security`		Express middleware hardening.
`eslint-plugin-gemini-security`		Google Gemini SDK security.
`eslint-plugin-knex-security`		Knex security.
`eslint-plugin-lambda-security`		AWS Lambda hardening.
`eslint-plugin-mcp-sdk-security`		MCP SDK security.
`eslint-plugin-mongodb-security`		MongoDB injection.
`eslint-plugin-mysql-security`		MySQL security.
`eslint-plugin-nestjs-security`		NestJS framework hardening.
`eslint-plugin-node-security`		Server-side patterns.
`eslint-plugin-openai-security`		OpenAI SDK security.
`eslint-plugin-postgresql-security`		PostgreSQL security.
`eslint-plugin-prisma-security`		Prisma security.
`eslint-plugin-secure-coding`		Injection prevention.
`eslint-plugin-sequelize-security`		Sequelize ORM security.
`eslint-plugin-sqlite-security`		SQLite security.
`eslint-plugin-typeorm-security`		TypeORM security.
`eslint-plugin-vercel-ai-security`		AI SDK security.

Code quality

Plugin	Downloads	Description
`eslint-plugin-conventions`		Team-specific habits and styles.
`eslint-plugin-import-next`		Fast cycle + import-graph analysis.
`eslint-plugin-maintainability`		Cognitive load and clean-code patterns.
`eslint-plugin-modernization`		ESNext migration + syntax evolution.
`eslint-plugin-modularity`		Structural integrity and DDD patterns.
`eslint-plugin-operability`		Production readiness and resource health.
`eslint-plugin-react-a11y`		React accessibility / WCAG.
`eslint-plugin-react-features`		React best practices and optimization.
`eslint-plugin-reliability`		Runtime stability and error safety.

⭐ Support & follow

If this plugin caught a real bug for you, star the repo — stars are the signal that keeps the Interlace ESLint ecosystem maintained — and follow the writeups on Dev.to for the benchmarks and security research behind these rules.

📄 License

View README.md on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarks Star on GitHub