I am currently building an api for an app to communicate with. The api endpoints will be protected, so I'd like to use an OAuth flow with JWTs for security. My flow will go something like this:
- Receive and validate user credentials
- Issue an access token (JWT) and refresh token for valid credentials
- Verify integrity of access token then verify expiration
- If expired - send a 401 and expect to receive a refresh token which will then be validated and a new access token will be issued
- Else use user id claim to gather more context and continue on with request\
JWT integrity: A Compact JWT is comprised of three parts - header, payload, and signature. The signature is verified by applying the
algspecified in the header section to the base64url encoded header and payload sections separated by a '.' and then base64url encoding the produced value. Does this mean it is possible to create a phony access token? A stolen access token could be unencoded, user id stolen and inserted into a very similiar, but fake, access token. This fake token is then signed as a regular JWT is. When the server receives this access token, would this token not hold its integrity?
OAuth flow: Does this seem to be a proper flow? A user's refresh tokens will be stored in a database so they can be verified in the future (these will have a long lifetime). The access token will rely on its own integrity and the information contained within it since its lifetime is so short.