Questions tagged [jwt]
A JSON Web Token (JWT) is a signed token provided by a server to a client which can be used to validate certain claims, e.g. identity, that can be used for a third party, e.g. a service provider.
418
questions
0
votes
0
answers
38
views
ow do I move password securely between api and web?
I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
- 1
0
votes
1
answer
51
views
Best login flow for username and password authentication
I've been reading countless articles about login flows and what's the best for user auth, but it's all even more confusing now.
My scenario:
I have a simple app (capacitor spa) that has a simple ...
- 3
0
votes
0
answers
24
views
Dynamic values in JWT token [migrated]
I have a matchmaking server that I've wanted to use for a game I'm making in the future.
My issue lies with the JWT token.
How do I go about storing dynamic values in JWT tokens efficiently? I prefer ...
0
votes
0
answers
36
views
What's the best approach to storing JWTs on the client
I'm developing a web application and I want to use token based authentication, but after implementing the feature on the server side I got stuck on trying to figure out what is the best approach to ...
0
votes
0
answers
16
views
How can client credential authorisation work for multiple clients in an IAM system?
I have an IAM system where each entity entry for client credential flow will be associated with a tenant.
I have two scenarios:
one client app that can access target entity to access only client ...
- 1
1
vote
1
answer
86
views
Should I return JWT tokens on a login route even if I am using cookies?
I have built a basic REST API that uses Json Web Tokens for authentication. Currently, I have built my frontend to store the JWTs in localStorage. I have read this is insecure and want to switch to ...
- 11
0
votes
0
answers
51
views
What type of token is this?
I started noticing this kind of token in a lot of CTF tasks from different authors:
eyJlbWFpbCI6ImVtYWlsQG1haWxib3guZG9tYWluIiwiaWQiOjN9.ZLNCAQ.MxwKVKj_dramWyfT5XxT6g9U3xk
The structure is as follows:
...
- 3
1
vote
1
answer
60
views
What happens first in a request having both CSRF Token and JWT token, authentication or authorization?
This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error.
403 error means that ...
0
votes
1
answer
245
views
OIDC + Authentik: Which token to give to user for authentication?
I am implementing a web service with a front end and back end. Everything but the login endpoint requires authentication. For authentication I use Authentik. However, I have trouble wrapping my head ...
- 1
1
vote
0
answers
53
views
Is it bad practice to store passwords in a JWE? If so, why?
First of all, I know that passwords generally do not have to be stored in a JWT or JWS since the token in itself can be used to authenticate. My circumstances are very specific though.
In my program, ...
- 11
0
votes
0
answers
57
views
How is client side JWT signature validation beneficial from a security perspective?
I’ve been reading about how clients can verify JWT signatures using a public key provided by the server. I’m struggling to understand how this solves any issues.
The only attack I’ve seen which this ...
- 11
0
votes
1
answer
226
views
Where to store JWT refresh tokens
Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
0
votes
0
answers
76
views
Is there a security flaw in this system design?
I'm working on the authentication part of my application.
Previously, I was using Firebase but I decided to work differently for some reason.
As I never implemented such a system, I'm asking for your ...
- 101
0
votes
1
answer
50
views
Passing user identity to a different REST service
I have two use-cases I am trying to solve.
A HTTP Service-A hosted on XYZ domain tries to access HTTP Service-B on ABC domain. Service-B is a stateless HTTP API which does not have user concept. ...
- 101
0
votes
1
answer
58
views
Could the signature of a JWT/JWS be used as a globally unique identifier?
In other words, is a signature on a JWT or JWS always unique?
- 103
0
votes
1
answer
62
views
Will a verified JWT token always ensure that user is authenticated when signed by an authentication server?
Prerequisites
I have a client application (CA), an authentication server (AS) and a resource server (RS).
The resources on the RS must be accessed and usable only by authenticated users which have the ...
- 103
0
votes
0
answers
238
views
Strong reason to not send refresh token on every request?
I'm creating a backend that supports authentication with JWT tokens. I'm using the classic access token / refresh token combo.
the access token is valid for 5 minutes and allows the users to perform ...
- 135
0
votes
1
answer
219
views
Session based CSRF Tokens - What value do i use with JWT?
The Double Submit Cookie CSRF Token pattern is a stateless technique that doesn't require storage or a database. However, it's vulnerable to session hijacking attacks and sub-/sibling domains that are ...
- 119
0
votes
2
answers
59
views
Data Model for JWT claims
I'm implementing a JWT-based REST API for the first time and I'm trying to figure out what information to send back on the response entity when a user logs in. The strategies I am considering are:
...
- 337
0
votes
2
answers
62
views
Decorating headers after JWT authentication
I'm toying with the idea of terminating JWT after gateway ingress, and looking to see what sort of attack patterns would result.
Prerequisites:
Communication between services would use mTLS to ...
- 101
0
votes
1
answer
2k
views
How to pass authentication to iframe from host app?
I will implement a chat bot web app that can be used on other websites. I plan to to host this app in www.mysite.com and customers will be able display this chat bot inside an iframe on their sites. ...
- 1
1
vote
2
answers
224
views
Does a web access token need to be encoded?
Our sports site is unlocking one of its main services so it is no longer necessary to sign up to use it for a few days. Anonymous users would have access for a few days, then we would lock them out ...
- 111
0
votes
0
answers
54
views
Is storing access token in private data, refresh token in http-only cookie safe?
Backend: Django / Django Rest Framework, would be hosted at GCP k8s
Frontend: Angular, would be hosted at some CDN e.g Vercel
Authentication: JWT (https://github.com/jazzband/djangorestframework-...
0
votes
0
answers
370
views
best way to keep user logged in with cookie and jwt?
I'm making an SPA with Laravel REST API and trying to keep it stateless.
Right now I'm trying to achieve proper JWT authentication and 'remember me' functionality.
On successful login the client ...
- 11
3
votes
2
answers
381
views
Does jwt with asymmetric algorithm have a bad performance?
I'm using Envoy as the gateway of my micro-service backend.
Envoy provides me the JWT mechanism, which means that with the help of a public key, Envoy can validate tokens generated with a private key.
...
- 341
0
votes
1
answer
196
views
Bearer JWT client authentication and access token issued by authorization server
An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. ...
- 101
1
vote
0
answers
52
views
RESTful API with Google API and OAuth2
As the title says, I want to create a RESTful API (stateless) that will access Google API endpoints. First I want to authenticate the user and then use that token provided by Google to access Google ...
- 11
0
votes
1
answer
111
views
3rd Party API Key in cognito custom attribute JWT
I am developing an application where users need to provide an API key to a 3rd party service, our app (a serverless app on AWS with a dynamo db) then makes requests to that 3rd party service on behalf ...
- 103
0
votes
0
answers
49
views
How is group membership passed in with JWTs?
When working with authentication through JWT, I understand that it's the combination of iss/sub that identifies a principle for authentication. But with cases where authorization is shortly followed, ...
- 231
0
votes
1
answer
109
views
JWT and JWKS for server to server calls
I have an application that uses an OAUTH2 flow based on JWT and JWKS.
JWT and JWKS are used for the "client authentication": when the application needs to call the endpoint to flip the ...
- 643
0
votes
1
answer
204
views
JWT secret part from php password_hash() (128bit random salt and password hashed together)?
We are using JWT (Json Web Token), with HS256 algorithm.
Is it ok to use PHP's password_hash() functions output for the secret part?
It's output is a 128 bit random salt with the user's password ...
0
votes
0
answers
330
views
How to decode laravel cookie using app_key
I have found an issue in a laravel site; its .env file is public. I need a way to decode and decrypt the jwt session cookie used by default in laravel using the app key found in .env file.
I don't ...
2
votes
1
answer
407
views
Is it possible to steal a cookie without HttpOnly via CSRF?
Without giving too many details away, let's say that I'm auditing an API that:
Has access-control-allow-credentials: true
Has access-control-allow-origin: *
Needs JWT set in Authorization header for ...
- 23
0
votes
1
answer
105
views
How should JWT tokens be made?
I'm writing a simple website to help me grasp cybersecurity practices and I decided to stick to JWT tokens, but I have no idea about what I should write on the payload.
I've seen on many JWT token ...
4
votes
1
answer
236
views
REST API authorization
Let say you have a REST API, which you want to use as the backend for React application. The application supports user login. You use JWT authorization to make that REST API stateless. Now the problem ...
- 43
1
vote
1
answer
466
views
Authentication using JWT signature, without header and payload
I am evaluating JWT as authentication mechanism for an API. The idea is to use JWT as API key.
One thing I want to implement is revoking API keys. Since revoking involves a state change in my backend, ...
- 113
1
vote
0
answers
38
views
SSO and/or JWT: make sure web app's endpoints are protected
Let's say I'm building a web application (let's focus on the backend side) that is B2C. Users should be able to register with my application, using a SSO provider like Google or Facebook. Once they're ...
- 135
1
vote
0
answers
57
views
OAuth2/Cognito: Let trusted server act on behalf of user
I'm building a public HTTP JSON API using API Gateway with ID token authentication.
I now need a server that acts on behalf of users. Users message that server using a third party (think Signal or ...
- 11
1
vote
2
answers
161
views
How do you share private keys for signing e.g. JWTs inside Docker-Containers?
I've written an application in NodeJS which essentially only performs a login:
You send your username/password, and you retrieve an JWT (JSON Web Token).
Those tokens are being signed by a private key....
- 13
22
votes
5
answers
10k
views
If JWT tokens are stateless how does the auth server know a token is revoked?
I've read that JWT tokens are stateless and you don't need to store the tokens in the database and that this prevents a look up step.
What I don't understand is that according to RFC 7009 you can ...
- 625
1
vote
1
answer
69
views
How to prevent replay attacks with JWE?
I am used to using JWTs so when I needed the same behavior but with no plaintext user data I looked at JWE. JWE is very similar to JWT; however, I did not see the exp, nbf or iat fields which limit ...
- 127
1
vote
0
answers
34
views
Can the data between Express.js middleware be manipulated/tampered in any way?
In the node.js express.js framework there is middleware support. Let's assume I have two middleware - the first one, which verifies whether the JWT token is legit and not tampered with and the second ...
- 234
1
vote
1
answer
733
views
Is there any danger in refreshing JWT tokens directly without a refresh token?
So I wrote the following logic for my web app:
When a user interacts with the website it initiates a Backend call. In the backend every endpoint has multiple middlewares, of which there is a JWT ...
- 234
1
vote
1
answer
102
views
Google Auth - should you send the ID token to the FE, or create a new JWT?
I'm trying to understand what the best practice is here.
When a user signs in with Google, they then send you an 'id_token' which contains a bunch of information about the user, and the token ...
- 111
1
vote
1
answer
3k
views
Sending JWT token in request body
I'm testing an application that sends JWT token in the request body (in JSON) instead of the header. Is it less secure than sending JWT token in the request header (like Authorization header), which ...
- 1,283
1
vote
1
answer
54
views
JWT forgery by an internal attacker
I have an authorization server that generate JWTs, the JWTs are signed with a private key (RS256) stored on a hardware security module. The tokens are generated only after a successful authentication.
...
- 193
0
votes
1
answer
97
views
How secure is my auth system?
I want to use jwt tokens that are validated on my servers and for storing the token I am spliting the token into 2 parts the signature and the payload the signature is stored in an httponly samesite ...
0
votes
1
answer
399
views
refresh token without client_id and client_secret
I was reading the OAuth protocol docs https://datatracker.ietf.org/doc/html/rfc6749#section-6 where it implies that you don't need a client_id and client_secret to refresh an access token, just a ...
- 113
3
votes
3
answers
10k
views
Crack JWT HS256 with hashcat
Is it possible to crack a JSON Web Token (JWT) using HS-256 algorithm with hashcat on a normal PC?
hashcat password.txt -m 16500 -a3
How can I calculate how much time it will take?
JWT first section ...
- 33
2
votes
0
answers
673
views
Why do I have to store a refresh token in db
As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
- 21