Read the Auth tab#

GraphDagger decodes any JWT, OAuth token, SAML assertion, or Basic credential it finds, so you can check the claims and the expiry.

The Auth tab appears in the inspector when GraphDagger detects an authentication payload anywhere in the selected request or response. It decodes the payload, shows its contents, and flags anything suspicious about it.

Which payloads open the tab#

The Auth tab opens for any of:

  • A JWT in an Authorization header, a cookie, a query parameter, or anywhere in the request or response body.
  • An OAuth 1 or OAuth 2 token (bearer, basic auth, client credentials).
  • A SAML assertion in a request body or response.
  • HTTP Basic credentials in an Authorization header.

If the request has none of these, GraphDagger hides the tab.

What each payload type shows#

The tab shows one block for each detected payload.

  • For a JWT: the decoded header and decoded claims, the signature, the algorithm, and any standard claims (iss, aud, exp, and so on) with their meanings.
  • For OAuth tokens: the token type, the value, the introspected scope where available, and the expiry.
  • For SAML: the parsed XML, the issuer, the recipient, and the signed assertion blocks.
  • For Basic auth: the decoded username and password. A reveal control hides the password until you select it.

What the tab lets you verify#

The Auth tab helps you verify four things. The correct token goes out on the correct request. A JWT carries the expected claims. The exp claim is in the future. No auth payload leaks into a response that must not contain it.