4

I'm building a frontend/backend separated system where the user 2FA auths in and gets a JWT back to the client side.

I'm using angular and for now I just store that token in $window.sessionStorage and include it in the header of every request to identify/authorize/authenticate the user.

Is there a more secure store this token on the client side? Right now on logout I delete the key client side and mark it disabled in the database, but if the user just leaves the browser there's no guarantee that will happen until the token expires (6 hour expire right now).

Any thoughts on this or other threads that already answered it extremely appreciated!

1

Maybe you could implement idle timeout on the server and if you see no activity for certain amount of time (say 10 mins) mark the session expired.

  • You MUST use session limits on JWT since it is subject to MitM attacks. – Julian Knight Jan 8 '17 at 20:10
0

[EDITED]JWTs are meant to authenticate stateless applications and not for sessions, e.g., you will need to build an invalidation mechanism to invalidate individual tokens, a feature that is be required if you are using a session-based application1. The best practices for securing a JWT are explained by OWASP JWT Cheat Sheet. For the secure storage, you should take into account the following:

  • Storing the JWT in the sessionStorage container, not as a cookie.
  • When you want to make use of the token, use JS to add it as 'bearer'.
  • Fingerprint your token to prevent sidejacking attacks.
  • 2
    Could you maybe provide a bit more context regarding your links (especially the first one). Link only answers are not good. – Tom K. Apr 11 '18 at 9:36
  • Thanks for your feedback @TomK I already include it in my answer. – Santiago Aragón Apr 22 '18 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.