1

For starters, I don't have any prior knowledge of implementing security/authentication on backends and frontends because of various reasons. So please forgive my ignorance.

So I implemented JWT token authentication on my Golang API where logging in an account gives a token that is needed for the header of any succeeding API calls. Now, we'll have a device that needs to pass some data to the server through the API and I wanted to know if there's a way for that device to bypass the login part, because it would be autonomous, and still be secure in some way. Another problem I have is that the guy who'll mainly write the Arduino code is not that versed in programming, the guy is even afraid of looking at a not pretty printed json, so I'd like the solution to be as simple as possible for his side.

I asked our "smart friend" for suggestions, because I absolutely have no idea what is a good way to do what I wanted, and it suggested something the backend and the Arduino exchanging certificates, which honestly scared me, but I think is quite complex. Then I thought of making the Arduino pass a custom header that would grant it a power to bypass the token checking. And I told the "friend" about that and it seems to be usable, but I need to go https first(which is a question for another day). Is it advisable?

UPDATE: Basically, the device would just post stuff, nothing else. Because it's meant to collect data and pass those data to the server. It doesn't get data from the server. And the server, device, app would only be using a local network, no cloud server involved at the moment and on production as well.

2
  • Welcome to the community. It's not quite clear what your goal is what is this passthrough you're talking about?.. Jul 1, 2023 at 8:54
  • Sorry, I'm not great with terminologies, I usually just use a word that I know has a close enough to what I wanted to say. Basically, what I mean is that I want to give a way for the device(Arduino) to bypass login and sending a JWT token as a header when calling the POST endpoints of my server because it would be autonomous and stuff.
    – rminaj
    Jul 1, 2023 at 9:16

1 Answer 1

0

Either the API requires some form of authentication or the API requires none. There is nothing in between, like not having authentication for some devices or applications.

Trying to exclude specific devices or application from authentication would require to be sure that these are actually the expected device/app. But this means some form of authentication - maybe a different one from what the API usually requires, but still authentication.

The proposal of using client certificates is authentication and can be a very strong one if properly implemented. The proposal of having some kind of "custom header" is authentication too. But if the header is easy to guess or easy to reverse engineer (like looking at the source code) then it is only a weak authentication. It still might be sufficiently secure, depending on the actual use case.

If the only task of the device is to call a low-risk API where no actual harm is done when unauthenticated users call the API, then such a special header might be sufficient. But the server must ensure, that this weak authentication cannot be used for anything else then.

If the device should instead have full access to the server application or maybe even impersonate other logins on the device, then you are essentially creating a backdoor with only weak protection. This is definitely not a good idea.

10
  • Basically, the device would just post stuff, nothing else. Because it's meant to collect data and pass those data to the server. It doesn't get data from the server. And the server, device, app would only be using a local network, no cloud server involved at the moment and on production as well. So I guess the custom header is sufficient for my use-case right now. You have any advice how to create the value for the custom token?
    – rminaj
    Jul 1, 2023 at 7:55
  • @rminaj: "just post stuff," says nothing about the actual risks involved. Is it fine, if somebody else which access to the token just posts stuff too? Has it any impact of what gets posted or are the data posted just thrown away anyway? What impact has a potentially compromised token and how will you deal with this? " how to create the value for the custom token?" - Since nobody has to enter it by hand just use a long random value. But again, your use case is not sufficiently clear to know if such a token is sufficient. Jul 1, 2023 at 8:34
  • Ok, so the purpose of the system is for monitoring. And the device's purpose is to collect data from sensors and send those data to the server. Then an app would display those data. Whatever is sent to the server, I just save it as-is, of course it has to have the fields that I need and the server only accepts the specified data type for each field thanks gorm. Again, I don't have much knowledge about infosec so I don't know what the risk for my current setup is.
    – rminaj
    Jul 1, 2023 at 9:12
  • @rminaj: Imagine someone having access to this authentication token and then accessing your API as an authenticated device. They then send to the API endpoint a) well-formed data with bogus values, b) completely unexpected data (not well-formed) - or c) they try to access other parts of the API which is not in scope for what the token is for. What will your application do in these cases, i.e. a) accept bogus data as valid b) reject request c) deny access d) undefined behavior, including crashing or remote command execution. Jul 1, 2023 at 9:44
  • hmm. That's quite a difficult thing to answer, because all the values that I would be receiving are numbers, floats to be exact. Some values may fluctuate, some should only go up(just got reminded that I have to these checks, it was on the plan but I just forgot). We do have a plan to have an alert feature that notifies the human users if some values exceeds an allowed threshold, so I could have a notification if a value hits/exceeds a value floor as well. That's my answer for a) I guess.
    – rminaj
    Jul 1, 2023 at 10:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .