I have implemented a stateless auth over HTTP in Laravel, using JWTs.
- I send my username/password from the frontend.
- Server authenticates user, sends back a signed JWT with an expiry time.
- I'm using the HS512 algorithm to sign with a private key (only available to the server).
- Frontend stores the token for future requests.
- Frontend sends next request with the token included.
- Server verifies that the token is valid, and not expired, and lets the action continue if yes to both.
- When the token expires server sends a 'logged-out' message.
All these communications happen over HTTPS.
So I can see that this is secure from these points:
- Attackers can't sniff traffic and steal the JWT token because of HTTPS.
- Attackers can't generate and send any odd token because server verifies the signature using its private key.
- Attackers can't modify which user (and hence, the role+permissions of the requester) is making the request, because that's part of the
subclaim in the token.
But, I have two questions:
- What if there is a virus on the user's computer or mobile, and it stole a valid token from RAM or from the browser. It can then send more requests, and they will be accepted. Is there any way at all to protect against this?
- Is there another way to attack this system that I am not seeing?