I already read good answers about preventing replay attacks with JWT and a lot of resources like jwt.io.
The conclusion was that I needed to use the
jti claim. From: Can I prevent a replay attack of my signed JWTs?
My schema right now is simple:
- User logs in.
- Server answers with a JWT.
- Client checks if it's valid and stores it.
- Client sends the JWT.
- If it's valid the Server answers with a new JWT.
- Wait 30 seconds
- Go back to step 3.
So I started using
jti, On step 4 it will use the jti stored on db from step 2 and create a new one for the next request.
While this works to prevent replay attacks on the server-side, it doesn't for the client-side. The flaw I found is: What if user redirects the traffic and always answers the same jwt, the client will think "hey this jwt is valid".
I had the brillant idea of saying "well, the jwt can't be the same as the last one". And found another flaw: now the user only needs 2 jwts to break it.
And now I have no idea on how to prevent this. I can't save all the jwts on the client side.
@edit: I forgot to add, this desktop app requires constant internet connection, it's like a game where you login and if someone logs in with your account you get kicked because your session is not valid anymore.
I'm trying to prevent multiple users on the same account at the same time, and ofc trying to prevent the user from using the same jwt and not needing to login anymore. (it's a paid software)