1

I am trying to implement an authentication/authorization system using JWT for my web application. The clients are provided with a token on the usual JWT format from my server once they present credentials which I check against the database.

The problem that I thought might arise is that from what I know JWT tokens are not encrypted or signed in any way so I might be a victim of MitM where someone is changing the claims in my payload and send a response or just steal data.

I figured out that this could be fixed by signing the JWT token using HMAC or better using RSA private/public key pair but again the RSA public key should have some kind of certificate attached cause the public key could be compromised at some point.

This is when I asked myself: 'Is it really necessary ?'. If I am getting a SSL certificate for all my pages and I communicate my tokens through it should I also sign them at 'application layer' ? Seems to me that I am just getting paranoid thinking that my CA could be compromised and someone could see my JWT tokens while are sent from the server. What are the chances of this happening ? Should I really take the time to develop one extra security layer before SSL where I generate a JWT token secure it with RSA private/public key pair and then send it to the user through an SSL channel ?

2

"Signing" JWT's is not a defence against Man-In-The-Middle attacks. As you say, using HTTPS so that TLS/SSL employed is.

Adding an HMAC to a JWT prevents the current user of the session from tampering with the claims.

Take this one:

{
  "admin": false
}

A malicious user may be able to escalate their privileges:

{
  "admin": true
}

Ensure that you have a strong private key and a HMAC authenticated token is enough. Ensure that every JWT checks the HMAC authentication.

RSA is only really useful if you need to send a token to another party or server and you wish to solve the key distribution problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.