0

I need help on a solution for below scenario from a security perspective.

Scenario:

There are two independent web applications App1 and App2. User will log in to App1 by performing authentication demanded by App1. Once authenticated, the user will find a hyperlink to access App2. On click of the hyperlink, App1 will pass the minimum parameters required for session creation (user-id) to App2. User should be logged into App2 in a ’new tab’ on behalf of passed 'user-id’.

Current approach:

By means of asymmetric cryptography, App1 will have a key-pair. App1 creates a JWT token (embedding ‘App2 user-id’) as part of initial handshake with a JWT expiry and post it to App2. App2 verifies the JWT signature of App1 and checks for the JWT expiry. On success, App2 continues to create a session for the user in a 'new tab’.

Problem:

Although the JWT is sent over https, it's not opaque during transit. While secrecy being an issue, what are the other security risks in the current approach? What could be a better authentication handshake, as opposed to the aforementioned process?

Thanks in advance.

0

JWT can either be signed, encrypted or both. Please use the case of encrypted and signed for secrecy of the App2 user-id (and other details) transmitted via JWT. Please refer this for more details. It's recommended to sign and then encrypt but vice versa is also possible.

  • Thanks for the pointer to IETF. Much appreciated. – ashok Apr 17 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.