I'm trying to implement a cookie-less authentication mechanism for a web API that is stateless on the server (does not store session tokens) and can be load balanced across several servers.

I have implemented a JWT that gets returned to a client (mobile phonegap client) which gets stored in sessionStorage, and added to the header of post-authentication requests. While this works perfectly fine on a single server, I always want to have a standby server which can handle requests that initially authenticated on a different server. For this, I'm assuming that I will have to share keys amongst the different servers.

I don't understand the security implications of moving public or private keys across servers. Is it completely unadvisable? If so, how can I meet my requirements? If not, are there standard methods for sharing keys? For example, a distributed config service like etcd? Manual ssh transfers? Is it more advisable to have a single server handling authentication, and then just share the public keys amongst the servers for decrypting the token for calls to the rest of the API?

  • For clarification: You want clients to be able to authenticate between multiple servers? – RoraΖ Oct 13 '14 at 19:32
  • I want a client to be able to log in on any server, and receive a token for the session that can sent via header to be decrypted on any other server – dannytoone Oct 13 '14 at 20:54

If you don't want to share keys AND you use asymmetric keys then you can key each server separately and have each server set a different iss (issuer) claim. Then the recipient of the JWT can "look up" the appropriate public key based on the iss claim. Our lookup was basically a config file that mapped the iss value to a file system location of the public key.

If you need to share secret keys then I'd look at key distribution techniques. A lot will depend on how much effort you want to put in.

|improve this answer|||||
  • The iss claim encrypted in the token, isn't it? – dannytoone Oct 14 '14 at 17:28
  • @dannyone We used a signed JWT. Our API servers can look at the claims for iss and then pick the correct public key to verify the signature. – Patrick Oct 14 '14 at 17:46
  • For people that confused to get iss value, some library provide a functionality to extract iss value from the token. Example: github.com/lcobucci/jwt/blob/3.2/README.md – fian Jan 15 '18 at 5:42
  • Keep in mind that this only works for signed web tokens (JWS), not encrypted web tokens (JWE). The contents of a JWS are still visible. – elslooo Apr 12 '19 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.