Problem
Lightweight identity provider that signs, decodes, and verifies JSON Web Tokens with HMAC-SHA256, demonstrating tamper detection and expiry handling end to end.
OAuth2JWTHMAC-SHA256AuthNNodeCase study / interactive demo
Case study
From problem to working system
My role
Security engineer and full-stack developer
Solution
Lightweight identity provider that signs, decodes, and verifies JSON Web Tokens with HMAC-SHA256, demonstrating tamper detection and expiry handling end to end.
Architecture
The implementation combines the following technologies and system concerns.
OAuth2JWTHMAC-SHA256AuthNNode
How it was built
- Implemented JWT signing and verification with HMAC-SHA256, including the exact base64url encoding rules that trip up hand-rolled implementations.
Security decisions
No project-specific security control is documented in the current project record. The case study avoids claiming controls that were not verified.
Major challenges
- Demonstrated tamper detection by mutating the payload and showing signature verification fail, which is the property the whole scheme rests on.
- Enforced expiry, not-before, and issued-at claims with clock-skew tolerance rather than accepting any structurally valid token.
- Showed the algorithm-confusion failure mode explicitly, since accepting the token's own alg header is how real identity providers get bypassed.
Verified evidence
Results and measurable impact
- Enforced expiry, not-before, and issued-at claims with clock-skew tolerance rather than accepting any structurally valid token.
- Showed the algorithm-confusion failure mode explicitly, since accepting the token's own alg header is how real identity providers get bypassed.
- Separated decode from verify in the interface, because reading a token and trusting a token are different operations.
- Kept the signing secret out of the client entirely, with token issuance server side only.
No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.
Screenshots and access
Product view
Interactive Demo
A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.
secureauth.zainkhalilkhan.com
SecureAuth
Security platform
Sandbox telemetry
SecureAuthWorkspace3 updates
SecureAuth · JWT Identity Provider
A real HMAC JSON Web Token is signed in your browser with the Web Crypto API. Edit the claims, switch the algorithm, rotate the secret, or mangle the token body, then verify to watch tamper detection and expiry checks catch the change.
Signed JWT (editable, try changing one character)
Header
(empty)
Payload
(empty)
Signature (HMAC)
(no signature)
Zain Khalil Khan
Client-side sandbox. State is in memory and nothing is sent to a server.