JWT Validation arrives in Cloudflare API Gateway
Cloudflare has announced the general availability of JWT Validation in API Gateway, giving customers a way to enforce positive security models for authenticated API traffic. The feature validates incoming JSON Web Tokens against broken authentication attacks, checking that tokens were previously verified by an identity provider, haven’t expired, and haven’t been tampered with.
The GA release follows a beta in early 2023 and incorporates feedback from customers. Cloudflare shipped updates addressing four key requests: support for additional signing algorithms, more flexible token extraction from requests, improved handling of JWKS endpoints, and enhanced error reporting.
Why API authentication matters
Broken authentication ranks as the number one threat on the OWASP Top 10 and the number two threat on the OWASP API Top 10. Real-world incidents back this up. Cloudflare previously documented how authentication flaws at Optus allowed a threat actor to offer 10 million user records for sale, and government agencies such as CISA have issued warnings about these exact attack patterns.
The distinction between authentication and authorization is central to understanding the risk. Authentication establishes who a user is, like when multiple collaborators are all verified as authors in a shared document. Authorization establishes permission levels, like when a document owner grants view-and-comment access rather than full editing rights. For APIs, failing to check authorization after authentication can enable broken object level authorization attacks, where one user accesses or modifies another user's data simply by making the right HTTP request.
The evolution of access tokens
Early web authentication used HTTP Basic Authentication, transmitting username-password pairs as headers that were visible to any observer unless the application enforced SSL/TLS. Hard-coded credentials and broad authorization policies complicated API access further.
API keys improved the situation by decoupling authentication from user credentials, but keys are still long-lived secrets susceptible to interception and to poor storage practices like being checked into source code.
JWTs solve several of these problems. They are cryptographically verifiable, auto-expiring, short-lived sessions that don't require sending long-lived secrets with every request. The structure is straightforward: three base64-encoded segments separated by periods. The header declares the signing algorithm, the payload contains claims about the user and token, and the signature is generated by the issuer using either a private secret or a public/private key pair. Anyone with the public key can verify that the token was legitimately issued and hasn't been modified.
Three attacks JWT Validation blocks
Security incidents involving poorly secured APIs are common. In the Enterprise Strategy Group survey "Securing the API Attack Surface," 39% of developers admitted skipping security processes to keep pace with CI/CD, and 57% of organizations faced multiple security incidents related to insecure APIs in the prior 12 months. Cloudflare's JWT Validation targets three specific categories of those attacks.
Missing or broken authentication
The simplest attack involves sending requests with no token at all. A user may log into an application and interact with it normally, but nothing stops that same user from crafting an HTTP request outside the application to read or modify another user's data. If the API has no enforcement requiring authentication tokens, it will happily respond to whoever asks.
JWT Validation drops incoming requests that lack a valid token, shutting down this class of attack entirely.
Expired token reuse
A more subtle problem occurs when applications decode JWTs and check user claims for group membership or feature access, but never verify the token's expiration time. A user downgrading from a paid plan could replay an old token with elevated access claims and continue receiving paid benefits indefinitely.
JWT Validation checks the exp claim, preventing such replay attacks with stale tokens.
Claim tampering and privilege escalation
The most dangerous scenario is a valid token with modified claims. If an application authenticates users, validates claims, and checks expiration times — but doesn't verify the signature — a malicious user can change their own token claims to assume an administrator role. The attacker starts with a normal account and elevates privileges without any credentials other than their own.
JWT Validation verifies that signatures are intact, so tampered tokens are rejected before they reach the origin.
How this fits with other Cloudflare JWT features
Cloudflare Access also creates and sends JWTs as part of its Zero Trust suite, and Cloudflare recommends validating those tokens at the origin. JWT Validation in API Gateway serves a different purpose. Access protects internal users and employees; API Gateway's JWT Validation is a security layer for external users and works with pre-existing JWTs from any identity provider without restructuring the existing user flow.
Cloudflare notes that some customers use custom Workers for JWT validation — a valid use case — but API Gateway offers a more straightforward management experience for common scenarios. Customers whose custom Worker logic exceeds the current feature set of JWT Validation are encouraged to provide feedback for future expansion.
Roadmap
Cloudflare plans to extend the service beyond validating pre-existing tokens. Future releases will let customers generate authorization policies and issue keys and tokens entirely within API Gateway, including through the on-demand developer portal. The company also intends to use its knowledge of API traffic patterns to suggest security policies automatically, targeting broken object and function level authorization attacks beyond the JWT validation use case.
Existing API Gateway customers can enable the feature from the Cloudflare dashboard. Enterprise customers without API Gateway can sign up for a trial to evaluate it.
