I'm building a site with Spring, which requires authentication in order for accessing certain pages.
The site is actually composed of a client host, which render the views and handle the data binding, and a REST api host (built with Spring as well), it's responsibility is returning/manipulating data, validation/generation of user token etc..
I've decided to implement a custom authentication in the REST side, upon receiving a valid username and password, it will return:
- JWT signed by the REST API with AES-256, the payload will contain the user id and expiration date.
- The JWT is stored on a cookie, which is HTTP only, secure, and valid only from the client site domain (is it enough to counter measure csrf attacks?)
The only backdoor I could think of is if the attacker steals the cookie, for which I could add to the JWT payload a unique random value for the user (which is stored on the database), and in the case the user is suspecting that his session was stolen, he could issue a request to reset the unique value, rendering the stolen token useless.
Am I missing any backdoors which could allow an attacker to bypass the authentication easily? Should I use Spring Security instead? I'm afraid I will not be able to achieve the stateless behaviour I currently have...