2

I have read the details of pure JSON web token (JWT), and found that it is signed (e.g. by SHA256) but not encrypted. Hence, attack can read the sensitive information by decoding the header and payload.

I am not very familiar the details of OpenID, but I know that OpenID uses JWT as data format to pass the token.

My question is:

In OpenID (e.g. OpenID 1.0, 2.0, OpenID connect), is JWT further secured by applying additional encryption or other approach, to prevent token stolen or information leakage (I believe the answer should be yes)? And how?

Improve this question

1 Answer 1

Reset to default
2

Earlier versions of OpenID don't use JWTs, so in a word: no.

OpenID Connect does not mandate the use of encrypted tokens as it prioritizes adoptability over security. However, it does allow you to optionally encrypt the token as a supported protection.

ID Tokens MUST be signed using JWS and optionally both signed and then encrypted using JWS and JWE respectively, thereby providing authentication, integrity, non-repudiation, and optionally, confidentiality, per Section 16.14. (Source)

Otherwise, the better way to think of it is that the protocol uses JWT to protect itself, not the other way around.

With that said, the protocol spec does list off a number of considerations. These include mitigations like

  • using HTTPS
  • verifying the token is actually signed with the right key
  • signing token requests
  • the token should include token restrictions
  • Blocking open redirects
  • using a cache to prevent token reuse

And so forth. A lot of these are common sense mitigations that should apply to any number of token-based protocols.

Improve this answer
2
  • what kinds of token format was used in old OpenID? any protection on the token itself?
    – TJCLK
    Commented Feb 23, 2017 at 4:17
  • @LiDong The older versions of OpenID use a primitive token made up of a hashed reference value. There aren't any claims within the token itself. The problem with doing it this way is that any identifying information isn't protected by the signature because its stored outside the token.
    – Steve
    Commented Feb 23, 2017 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .