1

I am building a web app, which is made of a Node.js Backend and Angular (NOT AngularJS!!! I only used the tag, because Angular was not available..) Frontend.

How do I properly secure this app? I already have an idea to use JWT tokens (I already implemented this) with a set expiration date, which will be way longer than the Frontend timer. The frontend timer should be like 15 minutes of inactivity. But how do I secure this Frontend timer against RAM modification with tools like Cheat Engine and also JavaScript modification/injection/editing? Are there any flaws in this logic? Any suggestions?

I was thinking of renewing JWT tokens, but that's apparently not possible. I am sure there's something wrong with my logic but I can't put my finger on it. Maybe I am lacking general sessions and their management?

Improve this question

1 Answer 1

Reset to default
3

You can't rely on the client code

General rule of thumb: once you send code down to the client to run on the user's machine, it's not your code anymore. The only security you can count on is security that's enforced by the server.

Stateful vs stateless

When designing a JWT mechanism you have to choose whether you want the server to track sessions in some sort of cache or not

Pros of stateless:

  • JWT is entirely self-contained; everything the server needs to know about the user and session is contained in the JWT (either a signed JWS if the contents are non-sensitive, or an encrypted JWE if the contents are sensitive).
  • Low server memory footprint (no cache) and latency (no db lookups).
  • High horizontal scalability because there is no cache to syncronize.

Cons of stateless:

  • No way to revoke a token -- the JWT will be valid until it expires (for example, no way to robustly do a logout mechanism).

Hybrid solution: short-lived JWT with Refresh token

The best-of-both-worlds solution that I like is to issue sort-lived stateless JWTs (expires in 5 - 15 mins), and also issue a long-lived stateful Refresh token (expires in weeks - months). That way the flood of API requests that happen on page load are using the high-performance stateless token, but you get to enforce logout every 5 - 15 mins when the client needs to trade in its Refresh token for a fresh JWT and Refresh token.

Auth0 has a nice writeup of this solution here:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .