I have built a REST API, where users login, with extra permissions in some cases (or restricted to certain areas of the site; or even admin privileges).
What I've built:
- JWT authorization (added to each request from ES6 [Aurelia] client)
- Backend Python [Flask] checks JWT for signature, invalid errors, expiration every time. All checks occur before each request... In the headers ("Authorization Bearer") to backend.
- Redis cache, timed set values, for storing sessions to reduce constant signature checks on each request (overriding the above a bit).
- Cookies restricted to domain by default is the main delivery of the initial authentication. Cookie brings JWT produced in Python.
- HTTPS for transmissions
- All my requests are application/json, aside from maybe 2 forms, and a number of GET requests which are just retrieving data
- I don't have anything where user info is being printed out based on the cookie or cache value.
- JWT has the domain set. Issued token must match IPs forwarded.
I don't believe (I could be wrong) I need to create an XSRF-token claim inside the JWT separately. Both the JWT & Redis cache items have expiration short enough (30 minutes). Not a single thing can be operated without logging in except for the redirect paths that take you to the login form. All major administrative functions require "confirmation" and "relogin" sometimes.
My goal is to knock out multiple birds with one stone through the JWT.
What improvements can I make to this? Am I vulnerable to certain types of attacks?