1

I have a reverse proxy, configured as the Relying Party of an OpenID Connect identity provider. Then, it delegates the request processing to another web server, exposed on the internet. In order to secure and authenticate this data flow, I thought I could use the RS256 algorithm to sign the ID token and pass it along the request. With this, the second web server would be able to verify the authenticity/integrity of the token without sharing a secret with the identity provider. This data flow would obviously be encrypted with TLS.

There's just one thing I'm not sure about: is it fine to use the ID token as a proof of authentication? The signature mechanism is designed to verify the integrity of the token, can it also be used to verify the authenticity? Is there a better practice in order to authenticate/secure this data flow?

4
  • What risks are you trying to mitigate in your attempt to "secure and authenticate this data flow"
    – identigral
    Sep 4, 2020 at 2:31
  • @identigral the thing I'm more worried about is identity theft and everything related to broken authentication since the second web server will expose personal user information on the internet so the access control needs to be reliable and this mechanism I'm thinking about is somewhat non-standard
    – Guerric P
    Sep 4, 2020 at 9:39
  • Access control to what? Expose personal user information how?
    – identigral
    Sep 4, 2020 at 19:07
  • Access control to personal user information
    – Guerric P
    Sep 4, 2020 at 20:02

1 Answer 1

1
+50

Yes, a signature proves the authenticity of the data. In an asymmetric algorithm such as RS-256, a signature can only be generated by someone in possession of the private key, and this can be verified with the public key. As long as the private key is kept secret, nobody else should be able to forge valid signatures.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .