We use JWT tokens in our Rest API(Bank API) authentication with a normal payload like:
{
"user_id": "cdda338f-50e2-4e14-9f84-33b8a158db9f",
"tenant_id": "cdda338f-50e2-4e14-9f84-33b8a158db9e",
// other jwt claims
}
However the security team thinks this is insecure and that we should replace the field names with non intuitive values, different for every application environment (prd,qas,dev), like this:
{
// would be user id, the key would be passed by an env var
"4234e798fdeikfj": "cdda338f-50e2-4e14-9f84-33b8a158db9f",
// would be tenant id, the key would be passed by an env var
"dkfgldsjf49385r": "cdda338f-50e2-4e14-9f84-33b8a158db9e",
// other jwt claims
}
Then the application would have to do this:
import TENANT_KEY from 'my-env-vars';
const tenantId = token[TENANT_KEY];
To me this seems like unnecessary complexity because we should not be concerned about our token being read by users since it does not hold sensitive information. It makes as little sense as to mask the api endpoints (replace /tenants/{id} with /dfkjsdfkjdsf/{id}). I think that if authentication is properly implemented, an attacker cannot take advantage of an intuitive API.
Since I could not find any articles about it, I would like to know if there are valid cases for this, if it is used by large companies or by yourself, what the possible benefits are and if there are better alternatives (JWE?).
I would also appreciate if you could point me to some good articles about this subject.
