Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [jwt]

A JSON Web Token (JWT) is a signed token provided by a server to a client which can be used to validate certain claims, e.g. identity, that can be used for a third party, e.g. a service provider.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

PHP JWT token flow in Symfony [migrated]

I am working on an app with separate front-end and backend. I need to create API routes which are protected by a JWT token. On login/register the user gets back a JWT token(short lived) and refresh ...
PVit's user avatar
  • 1
0 votes
1 answer
52 views

Best Practices for how to implement in-app user account switching

I am a developer responsible for mobile app and a couple of SPA web apps. Our customers are organizations ("tenants") with multiple users. Our authentication is built on OAuth2 (OpenID ...
mikejonesguy's user avatar
0 votes
1 answer
54 views

Are all stateless authentication systems vulnerable to IDOR?

I have recently been introduced to the Insecure Direct Object Reference vulnerability (https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html) with ...
Rands's user avatar
  • 1
0 votes
1 answer
53 views

Should I validate json web tokens on my app backend or login backend?

I wrote a login backend with express.js to provide authentication (through LDAP) and authorization (through a database of authorized users for each app on mysql). This backend generates jwt and sends ...
Harry Z. Huang's user avatar
1 vote
1 answer
95 views

Is it secure to send JWT tokens in url query parameters if we use nonce to make it a one time token?

Websockets don't support sending auth tokens during websocket handshake as part of HTTP headers, rather only via query parameters. This has a security risk of leaking these tokens in server logs. ...
Security Learner's user avatar
2 votes
1 answer
89 views

Does saving the cookie or jwt token in the browser raise a security risk?

I have an admin screen, once I access it, it asks for login credentials, then after I login, I get a token that is saved under local storage (see screenshot below) Noting that I am using edge browser ...
anonymous's user avatar
2 votes
1 answer
166 views

Openpubkey SSH workflow details

Currently looking into OpenPubKey and more specifically into OpenPubkey SSH: https://github.com/openpubkey/openpubkey https://docs.bastionzero.com/openpubkey-ssh Terminology: OPK => OpenPubkey ...
ieggel's user avatar
  • 225
3 votes
1 answer
162 views

Is it necessary to verify iss claim in a jwt if the jwk_urls are configured?

I am using auth0, and I have a setup a custom domain. As a result, depending on how I login, I can have multiple iss claims, for example : https://example.auth0.com https://auth.example.com So I ...
Logar's user avatar
  • 33
29 votes
5 answers
4k views

Why are refresh tokens treated differently than access tokens

If we consider that having a valid refresh token allows you to get a valid access token, then the two can be considered to have the same 'informational value' right? Then why are they treated ...
Javiliano's user avatar
  • 409
0 votes
0 answers
69 views

Single JWT as authentication and refresh token

I'm implementing an authentication mechanism using JWT tokens and exploring best practices for securely storing these tokens on the client side. My JWT includes a jti claim populated with random bytes ...
OhGodWhy's user avatar
0 votes
0 answers
72 views

OIDC identity token authentication using JWKS instead of token_introspection

This may be just an academic question, but I have been wondering about something, OK so for this purpose all we care about is AuthN, not AuthZ. Also, there are no users at all, just daemon-to-daemon ...
Optical Carrier's user avatar
1 vote
0 answers
94 views

Google Login with idToken and JWT (Java)

We are integrating Google login in our app and we intend to use the idToken for authentication. We are already sending the idToken from the app to the back-end server, and intend to verify the token ...
Lucas Basquerotto's user avatar
2 votes
0 answers
144 views

Storing bearer token in cookie for file retrieval in another tab

The existing system involves storing the bearer token in a cookie to fulfill a customer request of not only downloading an attachment within the application but also opening it in another tab. This is ...
Greg's user avatar
  • 121
1 vote
1 answer
128 views

Are JWT's needed when implementing passwordless magic link authentication?

I'm working on a web application where a user gains access by clicking on a magic link sent to them by an internal co-worker. Upon clicking this link, the user is automatically authenticated and a ...
Luka Demetrashvili's user avatar
0 votes
0 answers
77 views

OAuth2 component scopes

I'm currently implementing a system which consists of a collection of apps. Similar to the way Microsoft 365 consists of Word, Excel, etc. Ideally I'd like to log in once, then navigate between apps. ...
Andy N's user avatar
  • 502
0 votes
1 answer
257 views

JWT - Able to change signature and its still verified?

I just ran into something strange IMO. I created a RSA Key using nodejs cryptoutils to use with my JWT auth server. What I observer using jwt.io was the following: The last letter of the signature can ...
Gandalf1783's user avatar
1 vote
0 answers
190 views

JWT access vs refresh tokens

I have an application that I want to secure with JWT tokens. For what I have read, the common practice is to have very short lived access tokens and very long lived refresh tokens, so that when an ...
chronos's user avatar
  • 111
0 votes
1 answer
404 views

Do you need to invalidate JWT token upon password change?

We've got an Angular app that calls APIs with JWT token authentication (so an auth token and a refresh token). Now at some point the user changes his password (while normally logged in, so not with a &...
Steven De Groote's user avatar
0 votes
0 answers
87 views

ow do I move password securely between api and web?

I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
nikki's user avatar
  • 1
2 votes
1 answer
670 views

Best login flow for username and password authentication

I've been reading countless articles about login flows and what's the best for user auth, but it's all even more confusing now. My scenario: I have a simple app (capacitor spa) that has a simple ...
HRdev's user avatar
  • 23
0 votes
0 answers
157 views

What's the best approach to storing JWTs on the client

I'm developing a web application and I want to use token based authentication, but after implementing the feature on the server side I got stuck on trying to figure out what is the best approach to ...
iKingNinja's user avatar
0 votes
0 answers
63 views

How can client credential authorisation work for multiple clients in an IAM system?

I have an IAM system where each entity entry for client credential flow will be associated with a tenant. I have two scenarios: one client app that can access target entity to access only client ...
rishi s's user avatar
2 votes
1 answer
341 views

Should I return JWT tokens on a login route even if I am using cookies?

I have built a basic REST API that uses Json Web Tokens for authentication. Currently, I have built my frontend to store the JWTs in localStorage. I have read this is insecure and want to switch to ...
Jaanis's user avatar
  • 21
0 votes
0 answers
124 views

What type of token is this?

I started noticing this kind of token in a lot of CTF tasks from different authors: eyJlbWFpbCI6ImVtYWlsQG1haWxib3guZG9tYWluIiwiaWQiOjN9.ZLNCAQ.MxwKVKj_dramWyfT5XxT6g9U3xk The structure is as follows: ...
Andrey's user avatar
  • 3
1 vote
1 answer
290 views

What happens first in a request having both CSRF Token and JWT token, authentication or authorization?

This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error. 403 error means that ...
Aryaman Gupta's user avatar
0 votes
1 answer
1k views

OIDC + Authentik: Which token to give to user for authentication?

I am implementing a web service with a front end and back end. Everything but the login endpoint requires authentication. For authentication I use Authentik. However, I have trouble wrapping my head ...
Tim's user avatar
  • 1
1 vote
0 answers
129 views

Is it bad practice to store passwords in a JWE? If so, why?

First of all, I know that passwords generally do not have to be stored in a JWT or JWS since the token in itself can be used to authenticate. My circumstances are very specific though. In my program, ...
JoffLobster's user avatar
0 votes
0 answers
201 views

How is client side JWT signature validation beneficial from a security perspective?

I’ve been reading about how clients can verify JWT signatures using a public key provided by the server. I’m struggling to understand how this solves any issues. The only attack I’ve seen which this ...
JoffLobster's user avatar
1 vote
1 answer
9k views

Where to store JWT refresh tokens

Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either ...
simple_developer's user avatar
0 votes
0 answers
128 views

Is there a security flaw in this system design?

I'm working on the authentication part of my application. Previously, I was using Firebase but I decided to work differently for some reason. As I never implemented such a system, I'm asking for your ...
Big_Boulard's user avatar
0 votes
1 answer
109 views

Passing user identity to a different REST service

I have two use-cases I am trying to solve. A HTTP Service-A hosted on XYZ domain tries to access HTTP Service-B on ABC domain. Service-B is a stateless HTTP API which does not have user concept. ...
Sunil Dabburi's user avatar
0 votes
1 answer
256 views

Could the signature of a JWT/JWS be used as a globally unique identifier?

In other words, is a signature on a JWT or JWS always unique?
Travis Reeder's user avatar
0 votes
1 answer
124 views

Will a verified JWT token always ensure that user is authenticated when signed by an authentication server?

Prerequisites I have a client application (CA), an authentication server (AS) and a resource server (RS). The resources on the RS must be accessed and usable only by authenticated users which have the ...
condorwasabi's user avatar
0 votes
0 answers
988 views

Strong reason to not send refresh token on every request?

I'm creating a backend that supports authentication with JWT tokens. I'm using the classic access token / refresh token combo. the access token is valid for 5 minutes and allows the users to perform ...
Rififi's user avatar
  • 157
0 votes
1 answer
445 views

Session based CSRF Tokens - What value do i use with JWT?

The Double Submit Cookie CSRF Token pattern is a stateless technique that doesn't require storage or a database. However, it's vulnerable to session hijacking attacks and sub-/sibling domains that are ...
Advena's user avatar
  • 129
0 votes
2 answers
236 views

Data Model for JWT claims

I'm implementing a JWT-based REST API for the first time and I'm trying to figure out what information to send back on the response entity when a user logs in. The strategies I am considering are: ...
hotmeatballsoup's user avatar
0 votes
2 answers
143 views

Decorating headers after JWT authentication

I'm toying with the idea of terminating JWT after gateway ingress, and looking to see what sort of attack patterns would result. Prerequisites: Communication between services would use mTLS to ...
dardo's user avatar
  • 101
1 vote
2 answers
7k views

How to pass authentication to iframe from host app?

I will implement a chat bot web app that can be used on other websites. I plan to to host this app in www.mysite.com and customers will be able display this chat bot inside an iframe on their sites. ...
Ismail's user avatar
  • 11
1 vote
2 answers
883 views

Does a web access token need to be encoded?

Our sports site is unlocking one of its main services so it is no longer necessary to sign up to use it for a few days. Anonymous users would have access for a few days, then we would lock them out ...
dabadaba's user avatar
  • 111
0 votes
0 answers
842 views

best way to keep user logged in with cookie and jwt?

I'm making an SPA with Laravel REST API and trying to keep it stateless. Right now I'm trying to achieve proper JWT authentication and 'remember me' functionality. On successful login the client ...
Bufer's user avatar
  • 11
4 votes
2 answers
926 views

Does jwt with asymmetric algorithm have a bad performance?

I'm using Envoy as the gateway of my micro-service backend. Envoy provides me the JWT mechanism, which means that with the help of a public key, Envoy can validate tokens generated with a private key. ...
Yves's user avatar
  • 361
0 votes
1 answer
410 views

Bearer JWT client authentication and access token issued by authorization server

An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. ...
user890234's user avatar
1 vote
0 answers
103 views

RESTful API with Google API and OAuth2

As the title says, I want to create a RESTful API (stateless) that will access Google API endpoints. First I want to authenticate the user and then use that token provided by Google to access Google ...
ktop's user avatar
  • 11
0 votes
1 answer
245 views

3rd Party API Key in cognito custom attribute JWT

I am developing an application where users need to provide an API key to a 3rd party service, our app (a serverless app on AWS with a dynamo db) then makes requests to that 3rd party service on behalf ...
Woody's user avatar
  • 103
0 votes
1 answer
226 views

JWT and JWKS for server to server calls

I have an application that uses an OAUTH2 flow based on JWT and JWKS. JWT and JWKS are used for the "client authentication": when the application needs to call the endpoint to flip the ...
Marco Altieri's user avatar
0 votes
1 answer
403 views

JWT secret part from php password_hash() (128bit random salt and password hashed together)?

We are using JWT (Json Web Token), with HS256 algorithm. Is it ok to use PHP's password_hash() functions output for the secret part? It's output is a 128 bit random salt with the user's password ...
user288117's user avatar
2 votes
1 answer
991 views

Is it possible to steal a cookie without HttpOnly via CSRF?

Without giving too many details away, let's say that I'm auditing an API that: Has access-control-allow-credentials: true Has access-control-allow-origin: * Needs JWT set in Authorization header for ...
JulianGR's user avatar
0 votes
1 answer
177 views

How should JWT tokens be made?

I'm writing a simple website to help me grasp cybersecurity practices and I decided to stick to JWT tokens, but I have no idea about what I should write on the payload. I've seen on many JWT token ...
BurntRanch's user avatar
4 votes
1 answer
763 views

REST API authorization

Let say you have a REST API, which you want to use as the backend for React application. The application supports user login. You use JWT authorization to make that REST API stateless. Now the problem ...
random_đov's user avatar
1 vote
1 answer
928 views

Authentication using JWT signature, without header and payload

I am evaluating JWT as authentication mechanism for an API. The idea is to use JWT as API key. One thing I want to implement is revoking API keys. Since revoking involves a state change in my backend, ...
Nopx's user avatar
  • 113

1
2 3 4 5
9