I have a React (Javascript) single-page application that authenticates users via username/password/MFA to Keycloak, receives a signed JWT upon successful authentication, and then uses that JWT to call stateless/session-less REST services.

With this setup, or with additional "moving parts" to be added to the overall system, is there a way to at a later date to assert that a certain user identity was responsible for a transaction? Assume that we are able to store any/all data that is in-context (i.e., is part of the REST call for the transaction) at the time the transaction is requested.

Thanks to @alnbhclyn for their thoughts below. I think I need to clarify -- the key gap above seems to be the link between a JWT and the specific contents of a transaction. Is there a means of "signing" the transaction with the JWT or some part thereof such that a positive link between the two can be made at any point in the future?

  • Do you really need a token? If you need a token, it means you don't trust the authentication system. If you do trust authentication system, you don't need to store a token, you can store user ID. – mentallurg Jun 27 '19 at 21:08

You already have signed JWT token, if your HTTPd stores access log (and it have also cookies in that logs), yes you can find the identity later.

Be sure following items;

  • You will need the secret key of JWT (which that cookie have).
  • What is the algorithm of that signed JWT cookie
  • When you open that cookie, are you be able to identify the exact user or are you just able to see a GUID which will be stored at database and will be removed later ? For example some developers creates a session table and stores opened sessions on that table, jwt have that session identifier and as the last step with sign-out removes the row from table, if this is the condition JWT will not solve your problem. You need to be able to see a user identifier at your JWT data.

You can open JWT token and see what are you store on it, you can use this https://jwt.io/ website for it.

Notes of For access logging;

  • Access log only stores URL, HTTP Status Code, Method, Cookie, User-Agent and datas like that and does not store POST data this why if your endpoint understands the action over POST parameter. Access log will not identify action.
  • Nginx & Apache HTTP daemons have enabled access log configuration, IIS does not have enabled access log configuration at default, you need to configure it.
  • If you will use this data at SIEM, JWT token will be a problem, store your own log file for SIEM (if you are gonna use)
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.