First of all, I know that passwords generally do not have to be stored in a JWT or JWS since the token in itself can be used to authenticate. My circumstances are very specific though.

In my program, I need to startup a process as the user making a request to the server. As far as I can tell, you can only do so on Windows if you have their username and password. In this situation, would it be valid and secure to store their password in the body of a JWE? Or is there a massive security risk I’m not taking into account?

Any external references would be greatly appreciated since I can’t find much info on this.

I’ve looked around for info but all I see are generic JWE explanations which say “JWEs are a type of JWT used for sensitive data.”

  • Where are you planning to store the secret key needed to decrypt the JWE? That's an important part of the security of your idea.
    – bk2204
    Commented Jul 11, 2023 at 0:35
  • The secret key is stored only in the server's filesystem. @bk2204 Commented Jul 11, 2023 at 2:14


You must log in to answer this question.

Browse other questions tagged .