0

I have a large API and JSON Web Tokens (JWT) used for user authorization. These tokens are validated on frontend (nginx proxy) with Lua code. Now I want to secure my API a little more with browser fingerprints. The idea is to store client fingerprint in JWT token and pass this fingerprint from client to server with each request. If fingerprints match together, then it's ok, if not, then we block access, since our token was probably stolen.

There are many ways to create browser fingerprints and Fingerprintjs2 seems like a good solution. What I want to know is how in real world they store this fingerprint (or generate on the fly each time?) and how they submit it to the server (using cookies, headers, get or post parameters).

|improve this question
  • there are too many problems with this approach. – valentin Nov 6 '17 at 12:14
  • I would like to know some possible real world schemes, even though they may be vulnerable to some extent. – Jacobian Nov 6 '17 at 12:17
  • As for JWT, I'm using reference and access tokens. Access token is never passed to the client and this very token is supposed to store my fingerprint. So, what I'm interested to know about is just the client part of the problem - the way how I would generate or store fingerprint on the client and pass it to the server. – Jacobian Nov 6 '17 at 12:19
  • Based on your question I asume you are using openresty, I would suggest you look at lua-resty-session. Specifaclly the HMAC part. That way you ar eusing proper security practases and avoid broken fingerprint setups. – LvB Nov 6 '17 at 12:21
  • @LvB. Exactly! This is what I'm using now - openresty. – Jacobian Nov 6 '17 at 12:24
1

fingerprinting is used for anything but security, so do not use it for such a purpose.

Since you are using openresty, you can in fact add security to your session handler lua-resty-session has several different options as to where store the session data.

When you read pluggable-storage-adapters you see a table of storage adapters.

For your purpose I would suggest you implement one with Extra Security and implement HMAC.

This will make sure that the session data stays on the server, and that the client only has a HMAC token they can not alter without losing the session.

For additional protection you can add a little code to the authentication Lua to make sure the session is invalidated when the ip source changes.

I hope this answers your Question.

-- Including a comment I made to this awnser.

fingerprinting can be used to enhance the certainty of a specific user, it is however unsuited to replace other means of identification.

(see it like an ID check at a customs officer, your passport Identifies you, its number (and the check done by the automated systems) validates the document is real. and the image of your picture can be used to validate yourself to the officer. So in total while there is only 1 primary carrier of authenticity (the passport) there are many checks done to validate it.

Each check adds to the certainty that the person is who he/she claims to be. and as part of a authentication scheme you can add the fingerprint as additional information to proof identity. But it should never replace other proofs as its to generic, and to easily to forge or extract through other means.

|improve this answer
  • By saying that fingerpinting is used for anything but security, do you mean that there is actually no sense to store client fingerpint in a secured token and verify it on each request to make sure that it is you who owns this token? – Jacobian Nov 6 '17 at 13:01
  • the fingerprinting in this case (e.a. browser finger printing) is used to retrieve broad ideas about the clients that use your website. not to verify anything with any certainty. therefor its not usable as a security parameter. – LvB Nov 6 '17 at 15:14
  • Probably, you are right. Though, I've seen such articles as - w3c.github.io/fingerprinting-guidance - where it is said that "fingerprinting can be used as a security measure" and that "fingerpints can be used to identify users" and "correlate a user’s browsing activity within and across sessions". – Jacobian Nov 6 '17 at 15:22
  • fingerprinting can be used to enhance the certainty of a specific user, it is however unsuited to replace other means of identification. (see it like an ID check at a customs officer, your passport Identifies you, its number (and the check done by the automated systems) validates the document is real. and the image of your picture can be used to validate yourself to the officer. So in total while there is only 1 primary carrier of authenticity (the passport) there are many checks done to validate it. and each check adds to the certainty that the person is who he/she claims to be. – LvB Nov 7 '17 at 11:25
  • Thanks for a very informative comment! I think, it should be a part of your answer! – Jacobian Nov 7 '17 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.