Padding Oracle with Jwt Tokens

Padding Oracle attacks in JWT tokens exploit the way cryptographic padding is handled during decryption. JWT tokens commonly use RSA with PKCS#1 v1.5 padding or AES with CBC mode, both of which implement padding schemes that can leak information through timing differences or error messages.

The classic attack pattern works like this: an attacker captures a JWT token and attempts to modify it. When the modified token is sent to a server, the decryption process may fail. If the server responds differently based on whether the padding was invalid versus the signature was invalid, this creates a side-channel. The attacker can iteratively modify the token and observe responses to eventually decrypt the token's contents without knowing the secret key.

In JWT tokens specifically, this often appears in the following code paths: