Skip to main content

Format Confusion

Most OAuth2/OIDC bearer-token deployments expect compact JWTs:

base64url(header).base64url(payload).base64url(signature)

JWTForge uses compact output by default. Format-confusion testing intentionally produces JWS JSON Serialization instead, then sends that JSON text where a compact JWT would normally be expected. A compliant bearer-token parser should reject these values unless the application explicitly supports JWS JSON Serialization for that endpoint.

Flattened JWS JSON​

Set format to flattened to return JWS Flattened JSON Serialization:

{
  "format": "flattened",
  "body": {
    "sub": "user123",
    "scope": "read write"
  }
}
POST /token
Request
{
  "format": "flattened",
  "body": {
    "sub": "user123",
    "scope": "read write"
  }
}
Response
No response yet
Decoded token
No token yet

The response token is an object with payload, protected, and signature members instead of a compact JWT string.

General JWS JSON​

Set format to general and pass signatures to create a JWS General JSON Serialization token with multiple signatures:

{
  "format": "general",
  "body": {
    "sub": "user123",
    "scope": "read write"
  },
  "signatures": [
    {
      "header": {
        "kid": "rsa-key-1"
      }
    },
    {
      "header": {
        "kid": "alternate-rsa-key",
        "alg": "RS256"
      },
      "signature": "literal-secondary-signature"
    }
  ]
}
POST /token
Request
{
  "format": "general",
  "body": {
    "sub": "user123",
    "scope": "read write"
  },
  "signatures": [
    {
      "header": {
        "kid": "rsa-key-1"
      }
    },
    {
      "header": {
        "kid": "alternate-rsa-key",
        "alg": "RS256"
      },
      "signature": "literal-secondary-signature"
    }
  ]
}
Response
No response yet
Decoded token
No token yet

This is useful for testing whether application code verifies one signature but later reads or trusts a different signature entry.

Preset​

Use vulnerability: "format_confusion" when you want the preset form. If no explicit format is provided, JWTForge switches compact output to flattened JWS JSON:

{
  "vulnerability": "format_confusion",
  "body": {
    "sub": "user123"
  }
}
POST /token
Request
{
  "vulnerability": "format_confusion",
  "body": {
    "sub": "user123"
  }
}
Response
No response yet
Decoded token
No token yet

If you explicitly set format: "general", the preset preserves that choice.

Pentest Behavior​

The pentest generator includes format-confusion cases in the JWT vulnerability collection:

ScenarioJWTForge requestExpected target behavior
Flattened JWS JSON bearer tokenformat: "flattened"Reject with 401 or 403
General JWS JSON bearer tokenformat: "general" with multiple signaturesReject with 401 or 403
Conflicting payload hintformat: "general" with confusion.payload_hintReject with 401 or 403

For these tests, the generated JWS JSON object is serialized to JSON and sent as:

Authorization: Bearer {"payload":"...","signatures":[...]}

Accepting that value on an endpoint documented as accepting compact OAuth2/OIDC bearer JWTs is a format-confusion finding.