Are some STS token formats better than others (SAML vs SWT vs JWT)

Question

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used.

The corresponding help link takes me to MSDN documentation that doesn't cover security questions like this.

Is the difference in Token Format merely the manner in which it is serialized, (brackets versus semi colons) or is there a difference in the data that is encoded (such as checksums etc) that makes one format intrinsically better than another?

Or are certain tokens consumed by a application / language / platform that is less secure than others?

Answer 1

At the end of the day I don't think really matters, since it's a preference of format. SAML 2.0 is set in stone but is very large and verbose (as XML tends to be). But in my personal preference these days with my own projects. I say try out JWT tokens, which is a token in JSON format. If your client applications span across different platforms, it might be a lot easier looking at and handling a JSON object.

My client applications are

• Pure AngularJS application
• iOS iPad and iPhone app
• Windows 8 App
• Android App

And it's guarded by a Web API that accepts authorization header tokens with all the payloads in JSON format, so JWT seemed like a logical choice for me. When you're completely in .NET, for the ease of everything just use a SAML token.

When you're blatantly spread outside of just the pure Microsoft World: I highly recommend using JSON as a format over any other available ones. JSON is the format of the modern web these days so you're pretty much guaranteed that as well.

Answer 2

Better or worse is relative to the usage of the protocol. SAML has it's place and SWT/JWT/et al have their place. The SAML spec is pretty much set in stone, whereas SWT/JWT are really in their infancy and keep changing.

SAML has lots of knobs which makes it fairly complex and that's the enemy of good security, but everyone pretty much implements it the same way. SWT/JWT are fairly simple in design, but nobody can agree on a single bloody implementation standard and a lot of the public libraries used don't undergo security review.

It also depends on how the tokens are signed and how the keys used for signing are protected. Shared secrets tend to be more difficult to protect and PKI is a PITA, but others may disagree.