Changelog

2.6 2025-04-05

Add support for non-JSON claims within JWS (Thanks to @Hannah-PortSwigger for suggesting this).

Add Information panel to JWS view showing decoded iat, nbf and exp values (Thanks to @exploide for collaborating on this).
Add support for WebSocket messages containing JWT's.
Preserve JWT order when message has multiple JWT's.
Remove use of commons-lang3.

Fix issue where JWT's highlighted in Proxy regardless of config setting (Thanks to @serate-actual for reporting this).

Fix issue where an invalid Intruder signing key could prevent the extension from loading (Thanks to @sebastianosrt for reporting this).

Use split panes to improve JWT editor with small screens or large font sizes (Thanks to @eldstal).

Generate valid URL's when embedding Collaborator payloads within x5u and jku headers.

Forked from Fraser Winterborn's version (original repository).

Payload processing rule to support fuzzing within JWS.
Insertion point provider for JWS header parameters.
JWT highlighting within WebSocket messages.
Update to Java 17 and PortSwigger's new Montoya API.
Add ability to enable/disable JWT highlighting within proxied messages and to change highlight color.
Add ability to inject Collaborator payloads into x5u and jku headers.
Fix issue where invalid JWS's not recognised.
Add ability to export keys as a JWK set.
Add ability to sign with empty keys (CVE-2019-20933).
Add ability to sign with psychic signatures (CVE-2022-21449).
Color sections of serialized JWT differently.
Remove standalone mode.
Minor bug fixes and enhancements.