Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I would like to learn more about protocols using a JWT as a Token.
I'm aware of OIDC but I can't find any other well defined and robust protocols for user authentication using JWTs.
Sure, I can use a simple REST endpoint providing a JWT in exchange of valid credentials, but where can I find an RFC about that ?
Great question, and probably one that doesn't have a satisfying answer.
The JWT format is specified in rfc7519, but as far as I know it's kinda like HTTP: the standard headers are defined, but how you use them in your app is up to you.
For example, should your JWT contain only an expiry date, a sessionID, and a signature? Maybe that's ok if you have a strong server-side session mechanism. But if you're totally stateless then you probably need to carry more data in the JWT. Should it contain a userID? Should it contain group or access control info? Should it include info about how the user logged in - which portal, or which authentication method? Is any of this info sensitive enough that the the JWT should be encrypted so that the user can't see it? Is your web app designed such that all services that consume the JWT are able to share an AES private key to decrypt it?
TL;DR: I'm not aware of any RFCs or frameworks that tell you exactly what data should be carried in your JWT, but I'm also not sure this is really possible since the questions around what data you need to carry in the JWT depend heavily on the architecture of your app.
