9

I want to make sure that my use of JWT's in authentication is correct. There are a couple of issues that I don't understand. This is my current understanding:

  • When a user logs in, the server will create a JWT the third part of which is a signature that is created using a secret key.
  • In further calls to the API, the user can include the JWT in the header, and the server will be able to check the signature, again using the secret key. This means that an attacker that has intercepted the JWT cannot change the payload in any way, because if they do, then the signature will not match.

Questions

  • If an attacker manages to get hold of a JWT, will this not enable them to use the API as if they were the user that had originally authenticated?
  • I was thinking of including an expiry timestamp in the payload so that the user had to log in occasionally. Is this the correct way of expiring the JWT?

Thank you in advance.

6

Questions

If an attacker manages to get hold of a JWT, will this not enable them to use the API as if they were the user that had originally authenticated?

Yes. Same thing as if an attacker manages to obtain a users session id. However, this is why you want to limit the lifetime of JWTs.

I was thinking of including an expiry timestamp in the payload so that the user had to log in occasionally. Is this the correct way of expiring the JWT?

Yes. Plus you might want to add a revocation mechanism. This article provides a good introduction on the subject: https://stormpath.com/blog/token-auth-spa/

  • Thanks @user32387. So really, in order to prevent an attacker from intercepting the JWT and using it themselves, all of the calls, not just login, need to be made via https otherwise the JWT will be in accessible. Thanks for the link :) – Joe Oct 20 '15 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.