JWT kid Header Injection

The `kid` (key ID) header parameter tells the verifier which signing key to use. It is designed for key rotation. The JWT specification places no restrictions on the format of `kid` values: they can be integers, UUIDs, file paths, or any string. If the server uses `kid` to look up a key from a database or filesystem without sanitizing it, the value becomes an injection vector entirely controlled by the attacker.

How the attack works

The attacker controls the `kid` header (it is part of the token, which the attacker constructs). If the server interpolates `kid` into a SQL query (`SELECT public_key FROM signing_keys WHERE id = '<kid>'`), the attacker sets `kid` to a SQL injection string like `' UNION SELECT 'attacker-controlled-secret' --`, the query returns `attacker-controlled-secret` as the key, and the attacker signed their token with that same string: verification passes. If the server builds a file path from `kid` (`/var/keys/<kid>.pem`), the attacker sets `kid` to `../../dev/null`; on Linux, reading `/dev/null` returns an empty buffer, and HMAC with an empty key produces a predictable output the attacker can compute themselves.

The fix

Validate `kid` values against a strict allowlist before any lookup. Never interpolate `kid` into SQL strings or file paths. If you must use a database lookup, use parameterized queries: the `kid` goes into the parameter slot, not the query string, so SQL injection is impossible regardless of what `kid` contains.

Code examples

The attack (SQL injection via kid)

// Vulnerable server code
app.post("/api/resource", async (req, res) => {
  const token = req.headers.authorization.split(" ")[1];
  const header = JSON.parse(
    Buffer.from(token.split(".")[0], "base64url").toString()
  );

  // kid is attacker-controlled from the token header
  const result = await db.query(
    `SELECT public_key FROM signing_keys WHERE id = '${header.kid}'`
  );
  jwt.verify(token, result.rows[0].public_key, { algorithms: ["RS256"] });
});

// Attacker sets kid to:
//   ' UNION SELECT 'attacker-controlled-secret' --

The fix (allowlist + parameterized query)

// Allowlist approach: recommended
const VALID_KEY_IDS = new Set(["key-v1", "key-v2", "key-v3"]);

function getSigningKey(kid) {
  if (!VALID_KEY_IDS.has(kid)) {
    throw new Error(`Unknown key ID: ${kid}`);
  }
  return keyStore.get(kid);
}

// Or parameterized query: safe
const result = await db.query(
  "SELECT public_key FROM signing_keys WHERE id = $1",
  [header.kid]
);