Authentication Token Debugging

• Classification: Identify type (Expired, Invalid Signature, Aud/Iss mismatch, Malformed, Refresh Expired).
• Analysis: Explain causes (Clock skew, wrong keys, broken rotation, insecure storage).
• Remediation:
  • Expiry: Add refresh logic and clock skew tolerance.
  • Signature: Verify keys and rotation status.
  • Claims: Update generation logic (iss/aud).
  • Refresh: Implement secure rotation/revocation.
• Hardening: Recommend short-lived tokens (15m), httpOnly cookies, and explicit claim verification.
• Testing: Write tests for acceptance, expiry rejection, and tampering detection.
• Fallback: If no payload, provide decode commands and claim-verification checklist.

Edge Cases

Debugging Workflow

flowchart TD
    A([Start: Token Debugging]) --> B[Parse inputs]
    B --> C{Payload available?}
    C -- No --> D[Provide decode command]
    D --> E[Describe validation flow]
    C -- Yes --> F[Classify Error]
    F --> G{Type?}
    G -- TokenExpired --> H[Check exp vs now/clock skew]
    G -- InvalidSignature --> I[Verify keys/rotation]
    G -- InvalidAud/Iss --> J[Update generation]
    G -- RefreshExpired --> K[Implement rotation/revocation]
    G -- Malformed --> L[Validate base64url/segments]
    H & I & J & K & L --> M[Root Cause Analysis]
    M --> N[Apply targeted fix]
    N --> O[Security Hardening]
    O --> P[Write tests]
    P --> Q([Output: 5 Sections + Fix + Tests])

Examples

• Input Example
• Output Example

Quality Gate

• Fix is security-compliant.
• Secrets handled safely.
• Clock skew addressed.
• Tests included.
• Rotation strategy sound.

MCP Dependencies

• @upstash/context7-mcp: Library documentation and examples.

Changelog