I would like to ask a question about security in the case of SignalR, a library for real-time HTTP communication. I see it as an abstraction layer for web-sockets with fall-back mechanisms in case the browser (or server, or firewall) would not support web-sockets.

What I would like to know is whether the following procedure has security issues (e.g. session session hijacking):

After the authentication procedure a JWT token is generated the client sets the token as query-string property of the SignalR connection. This token is then used for authentication of each request on server side. The procedure is suggested here and here.

According to the documentation provided here (see 'CSRF mitigations taken by SignalR') SignalR does use the query-string already internally for authentication inside the library.

My question is whether it is secure to add my JWT token to the query-string and use it for authentication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.