Signing Key Compromise
Key compromise means an attacker obtained your HMAC secret or asymmetric private signing key used to mint JWTs. With that material they can forge valid tokens until you rotate keys and ensure every verifier stops accepting the old material. Response includes generating replacement keys, publishing new JWKS or secrets, dual-verifying briefly if needed, forcing re-authentication when risk is high, auditing access logs for forged sessions, and remediating the leak path such as git history, application logs, or stolen environment variables. Assume any token signed by the compromised key may be attacker-controlled until expiry or forced logout. Post-incident reviews should harden generation, storage, CI secret scanning, and access control around production secrets.
Why It Matters
Compromise turns your authentication system into the attacker issuance service until rotation completes. Preparation — kid-based rotation, secrets managers, and rehearsed runbooks — determines whether recovery takes hours or days of customer impact. Practice emergency rotation before you need it, and monitor for anomalous token issuance patterns that may signal stolen signing material in the wild. Maintain an emergency rotation runbook: revoke or remove the kid, rotate secrets/managers, invalidate long-lived refresh material, and communicate to dependent services. Time-to-rotate beats perfect forensics when forging is possible.
Related Terms
Related Comparisons
Related Tools
Related Articles
Frequently Asked Questions
Should I invalidate all sessions on compromise?
Usually yes for high-risk leaks. Short-lived access tokens limit damage, but refresh tokens and long-lived JWTs often need forced logout plus signing-key rotation.
Is deleting a secret from git enough?
No. Assume the secret was copied. Rotate signing material, revoke outstanding sessions where possible, purge history if needed, and audit where the leaked value may have been reused.
Do public JWKS keys count as compromise?
Public verification keys are meant to be public. Compromise means private signing keys or HMAC secrets leaked — rotate those immediately and treat issuance as untrusted until done.