1

My background is more onto SOAP, where we can do transport authentication and message authentication together. Basically we use http basic and SAML token in message payload.

Regarding jwt, I have questions:

  1. if jwt uses http heeder authorization, does it mean i cant use http basic(or digest) as first layer security?

  2. is it possible to put jwt in the message payload just like soap does?

Thanks in advance.

2 Answers 2

1

Depends how much you can deviate from specification.

As HTTP standard authentication token is being passed in Authorization header. But nothing prevents you from using this token somewhere else. Recently I worked with application where JWT was inside cookie, so nothing prevents you from delivering token as part of message body.

0
  1. I’m not sure why you’d want to use basic auth and JWTs. A JWT is a token that has already abstracted out the username/password combo for you, to further add username/password in basic auth is unnecessary, and introduces an attack surface. Once you use JWTs, don’t store the username/password client side.

  2. I haven’t read all the RFCs on JWTs, but technically it’s feasible to pass the token via the body as well. Although, the preferred method is via a http Authorization header.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .