I implemented my own Json Web Tokens authentication and authorization scheme, which is based on three tokens - access token, reference token and refresh token. They are generated by backend or application code and all authorization logic is implemented in middleware (in Lua code embedded in nginx).
These are some questions that are bothering me:
- Should I sign my reference token with RSA before I pass it to the client?
- Should I sign my refresh token with RSA? Obviously, like reference token, it does not store any critical information and therefore I'm not sure of that.
- Should I sign my access token with RSA, if it is never passed to the client and is only used on server side? I guess, I should, just like in case of hashed passwords stored in database.
- What are naming conventions for HTTP header in which I pass my reference token from server to the client? Is it ok to use just some arbitrary header like
- In what header should I pass reference token from client to the server side? Should I use
Authorization: Bearer ...(it seems like a standard convention) or is it ok to use just the same
- Is it secure (I guess, not) to pass refresh token to the client. And if not, how do they store it? Reference token is stored in client side cookies and passed with each request from client to the server, access token is never passed to the client and is stored in server side cache and where should I store my refresh token?
- Is it secure to use raw reference token value as a key, by which I get access token from server side cache? Let's say, my reference token is just some GUID, is it secure enough to use this very GUID as a key by which my access token is stored? Or is it more secure to get this key from GUID by some transformations?