Bearer header
A signed JWT is sent in the Authorization header.
Not sent
JWT Lab · Local DAST runtime
Capture one JWT carrier at a time.
Start PTK DAST, then send the review and control requests below. The valid synthetic token and user journey are identical; only server verification behavior changes.
HttpOnly session cookie
The runtime seeds a path-scoped HttpOnly cookie before the captured request.
Not sent
URL-encoded access token
The JWT is the value of one form field beside an unrelated preserved field.
Not sent
Nested access token
The JWT is nested at auth.access_token beside unrelated JSON data.
Not sent
Safe advanced simulation
What the vulnerable endpoints model
Algorithm-none and empty signatures can be accepted; unsafe key-path and remote-key header metadata produce deterministic evidence. Controls reject every mutation. The server never reads a path from the token and never fetches its URL.