I'm developing a web application which manages security and hygiene at work so the clients can access information about medical stuff, like exams, reports, accidents, ability to work, things like that.
Info like this is rather sensitive, so I really want to make sure that every piece of info is secure in the best way possible. The web application is developed in Angular 5 and the API is developed in Asp.Net Core 2.0, I'm using JWT to authenticate and authorize a user.
So far in my research, I have found many articles discouraging the use of JWT and others stating that JWT has nothing wrong if used correctly.
REST Security Cheat-Sheet ( Not really a 'pro', but helps to implement)
I'm storing the token in a cookie (I know about the XSS and CSRF) and right now I've done this:
- Strong password mechanism ( hash and salt with a strong algorithm )
- JWT blacklist table in the DB ( to revoke tokens )
- The data inside the token is hashed (even if the token is stolen, they have no info from token itself )
And will do in the future :
- API accepting requests only from the client URL ( not 'AllowAnyOrigin' )
So, I'm on the right path? Should I stop right now? I've done something wrong? Any help is appreciated.