Cookie and Web Storage tokens
Seeds synthetic JWTs in a readable cookie, localStorage and sessionStorage.
Open storage reviewJWT browser and request evidence
Follow one synthetic token across the browser and HTTP request surface.
These paired cases demonstrate browser-storage discovery and exact Authorization, cookie, form and nested-JSON request carriers. All tokens are synthetic and intentionally non-secret.
Static hosting
JWT discovery in browser state
Open the review page, then open the PTK JWT tool. Compare it with the clean control on the same origin.
Opaque session values
Runs the same storage workflow with non-JWT values and clears review tokens first.
Open storage controlLocal runtime
JWTs in captured requests
Generate one bounded request at a time using Authorization, an HttpOnly cookie, a form field or a nested JSON property.
Four exact request carriers
Each vulnerable endpoint has a paired control with the same method, token and browser action.
Open local DAST casesAdvanced verification behavior
The same open fixtures also model algorithm-none, empty-signature, key-path and remote-key metadata handling without exposing private scanner rules.
Review advanced cases