I have a reverse proxy, configured as the Relying Party of an OpenID Connect identity provider. Then, it delegates the request processing to another web server, exposed on the internet. In order to secure and authenticate this data flow, I thought I could use the RS256 algorithm to sign the ID token and pass it along the request. With this, the second web server would be able to verify the authenticity/integrity of the token without sharing a secret with the identity provider. This data flow would obviously be encrypted with TLS.

There's just one thing I'm not sure about: is it fine to use the ID token as a proof of authentication? The signature mechanism is designed to verify the integrity of the token, can it also be used to verify the authenticity? Is there a better practice in order to authenticate/secure this data flow?

  • What risks are you trying to mitigate in your attempt to "secure and authenticate this data flow"
    – identigral
    Sep 4 '20 at 2:31
  • @identigral the thing I'm more worried about is identity theft and everything related to broken authentication since the second web server will expose personal user information on the internet so the access control needs to be reliable and this mechanism I'm thinking about is somewhat non-standard
    – Guerric P
    Sep 4 '20 at 9:39
  • Access control to what? Expose personal user information how?
    – identigral
    Sep 4 '20 at 19:07
  • Access control to personal user information
    – Guerric P
    Sep 4 '20 at 20:02

Yes, a signature proves the authenticity of the data. In an asymmetric algorithm such as RS-256, a signature can only be generated by someone in possession of the private key, and this can be verified with the public key. As long as the private key is kept secret, nobody else should be able to forge valid signatures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.