0

Prerequisites

I have a client application (CA), an authentication server (AS) and a resource server (RS).

The resources on the RS must be accessed and usable only by authenticated users which have the authorization to do so.

The AS and RS share the same secret for signing and verifying JWT tokens.

Neither token expiration time nor revoking mechanisms are considered for this specific use case. Tokens are considered to have lifetime expiration and can not be revoked.

Operations

The CA tries to authenticate to the AS.

Authentication succeeds.

The AS sends a JWT token to the CA. The token is signed but not encrypted. Also, the token will have the token issuer identifier, the user ID and the user roles as claims.

The CA interacts with the RS API providing the token in the Authorization header.

Questions

If the RS verifies the signature of the token, can it be sure that the request comes from a user which has been successfully authenticated via the AS?

In other words, in this scenario is it possible to have unauthenticated users to provide valid JWT tokens?

Improve this question

1 Answer 1

Reset to default
1

If all parties in your scenario ensure that the token doesn't get leaked, then, yes, you can assume that a valid JWT can only come from a client who has been successfully authenticated by the authentication service. That's really the whole point of JWT.

Preventing the token from getting leaked means:

  • It must only be transmitted over secure connections (e. g. TLS)
  • The client must store it in a secure manner
  • It must not show up in unprotected logs
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .