Questions tagged [jwt]

A JSON Web Token (JWT) is a signed token provided by a server to a client which can be used to validate certain claims, e.g. identity, that can be used for a third party, e.g. a service provider.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Can I store subject from a JWT from an external auth server in my DB?

We are retrieving external users using OpenID with the PKCE flow. We are using the JWT returned from the auth server to authenticate the user. If it is valid, we extract the subject field from the ...
user avatar
  • 101
0 votes
3 answers
115 views

Crack JWT HS256 with hashcat

Is it possible to crack a JSON Web Token (JWT) using HS-256 algorithm with hashcat on a normal PC? hashcat password.txt -m 16500 -a3 How can I calculate how much time it will take? JWT first section ...
user avatar
0 votes
0 answers
36 views

Why do I have to store a refresh token in db

As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
user avatar
  • 1
0 votes
0 answers
46 views

Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection

In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
user avatar
  • 101
0 votes
0 answers
86 views

Cracking HS-256 signed JWTs with large payloads

I'm testing a site that authenticates using an HS-256 signed JWT. However the json payload inside the JWT is about 2500 characters. This has become an impediment to trying to crack the signing key. My ...
user avatar
  • 131
0 votes
0 answers
42 views

Mitigating CSRF and XSS with JWT authentication: can someone tell me where my logic is wrong

I'm currently working on a personal project including a RESTful API and also trying to understand how to make it as secure as possible. I have read a bit about JWT, the possible vulnerabilities as ...
user avatar
4 votes
1 answer
199 views

Is there a reason not to store a JWT as hardened cookie?

When storing a JWT for authentication in a web application, my first instinct would be to store it as a "hardened cookie", meaning all the required flags such as "HttpOnly" and &...
user avatar
0 votes
0 answers
37 views

Use of JWT Token in open source project

I'm currently performing a code audit for an application that a company will release to the public as open-source in the next few days. In this application, they use a JWT token for authentication and ...
user avatar
  • 3
0 votes
1 answer
61 views

Can I safely expose a read-only RESTful API with no key or token?

As the title suggests, I would like to expose a couple of read-only endpoints without requiring a key or token. The endpoints will allow the user to request their data for the purposes of displaying ...
user avatar
  • 1
0 votes
0 answers
13 views

How to verify the reliability of the request (impersonation)?

I'm using JWT for authentication and I use HTTPS. For every request that is made to the server has a header with bearer Token which has an access token. To retrieve my user info Page I have coded my ...
user avatar
0 votes
1 answer
60 views

How to send JWT Access token with requests without being sniffed?

I'm trying to create a mobile app which helps to connect with my mobile app. While going through authentication I used JWT. While authenticating it, it returns access token and refresh token to the ...
user avatar
0 votes
1 answer
64 views

is it safe to read the jwt token before validating it?

is it safe to read the jwt token before validating it? my colleagues are implementing a "check jwt for aud value and route accordingly". this means that: First payload is being read by the ...
user avatar
  • 103
0 votes
0 answers
33 views

Refresh tokens in a web environment

As I understand it, the basic idea is that you have accessToken (15 minutes), and refreshToken (1 week), a few moments before the accessToken expires, you need to ask the server for a new accessToken. ...
user avatar
  • 161
1 vote
1 answer
96 views

JWT - validate scopes and/or claims against issuer

Is it logical or recommended to validate the presence of a specific scope and/or claim against the issuer of the JWT? For example, we will have a couple of different issuers of JWTs: One for ...
user avatar
0 votes
1 answer
121 views

JSON Web Token splitting

It's been quite a few years since the last time I did web development and I realized many things have changed: instead of stateful server-side sessions with authentication cookies and CSRF tokens now ...
user avatar
1 vote
2 answers
152 views

Should I fully trust JWT content

So I am using JWT authentication, then I want to implement authorization. Some resources only available for users with admin role for example. If I put the role in the token, is it a good idea to take ...
user avatar
0 votes
0 answers
54 views

What's the purpose of signing OIDC ID Tokens if they shouldn't be used as bearer tokens

It seems like signing ID Tokens invites misuse. As I understand it, OIDC ID tokens should not be used as bearer tokens for authorizing API access. Instead, we should use access tokens. However, the ID ...
user avatar
1 vote
0 answers
33 views

Using the same JWT token for the web and public API

Lets say my web client gets a JWT token for authentication so it can make request to the API server. Now, I'd like to create a public API (which will basically be the same as the api for the web ...
user avatar
1 vote
1 answer
220 views

JWT cookie with CSRF token as a claim inside the JWT

I am trying to figure out if the solution I am suggesting is valid for both XSS & CSRF protection, I would like to store the JWT in an httpOnly & secure cookie and not in local storage, when ...
user avatar
  • 113
0 votes
0 answers
72 views

When using a cookie to header CSRF protection with JWTs, how to implement refresh tokens?

Scenario I'm working in the oAuth flow for a new app, which is currently laid out like this A React web App A Rails backend FusionAuth as an Authorization server We are using the oAuth2.0 ...
user avatar
1 vote
1 answer
215 views

How to implement the CSRF token mechanism for restful APIs?

Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable: storing JWT in local storage(any where other than http-only cookie) ...
user avatar
  • 113
2 votes
1 answer
145 views

How to perform security analysis of jwt authentication libraries

I am working on security analysis of jwt python libraries. I want to analyze how the libraries work and how they were used in development. Not the source code. Also I have to check the jwt libraries ...
user avatar
  • 73
0 votes
1 answer
128 views

What is considered a secure way to store JWT in browser?

I'd like to rewrite a monolithic social website to use JWT for authentication instead of traditional cookie/sessionm, and I'm looking for a secure implementation. I read here that: You might think an ...
user avatar
  • 1
0 votes
1 answer
234 views

Security risks to returning JWT token in the response body to a GET request?

Are there any security risks to returning a user's JWT in the response body to a GET request? The JWT is only returned for authenticated users. Authentication is managed via a JWT stored as a HttpOnly,...
user avatar
1 vote
1 answer
101 views

How to trust the Kubernetes ingress controller?

In Kubernetes, I use an nginx ingress controller to do TLS termination and load balancing. When mutual TLS is used, the ingress controller can be configured to forward the client certificate as an ...
user avatar
  • 153
0 votes
0 answers
61 views

I have a non-Oauth service and am using this approach with Server initiated HttpOnly cookies with stripped JWT

My question is : Is this approach correct given I have a non-Oauth service? My goal is to use the simplest amount of security features while still being as strong as possible. My approach is as ...
user avatar
  • 101
1 vote
1 answer
194 views

Should I specify JWT audience and issuer if I have only one SPA client?

I have an API server (ASP.NET Core 5) and SPA client (ASP.NET Blazor). Nothing else: no external oauth servers, identity providers and whatnot To secure access, the server issues and validates access ...
user avatar
  • 353
0 votes
0 answers
60 views

Managing key storage and key rotation in a clustered authentication service

I want to build an authentication service that uses JWT with signatures generated using RS256. In a single-server solution, the implementation is rather straightforward. However, when it comes to ...
user avatar
0 votes
0 answers
70 views

Ways of Authentication in case server and client are hosted on different domains

I´m working on a project where user authentication is required. For some reasons we have to host the frontend and the backend on different domains. I usually send httponly cookies from server to ...
user avatar
  • 101
0 votes
0 answers
102 views

Access to JWT session after OAuth redirects

I have a stateless backend app, session data is stored on the front-end in a JWT token, so the front-end app passes this token in Authorization header to all the requests. I need to add 3rd party API ...
user avatar
  • 1
1 vote
0 answers
121 views

HMAC hashing vs JWTs for stateless authentication

For simple authentication with backend services, without more sophisticated needs (e.g. roles and scopes), is there any security benefit in using JWTs instead of sending HMAC hashes to verify a ...
user avatar
  • 162
0 votes
1 answer
352 views

OpenID Connect with or without reverse proxy?

Many popular reverse proxies (tomcat, nginx, ...) seem to handle OpenID Connect and act as a Relying Party to hide the authentication complexity to all applications behind the reverse proxy, which ...
user avatar
  • 33
0 votes
1 answer
304 views

Can I reuse the refresh token as the remember me token?

I have an application with a server-client architecture. The server is a REST/JSON API and the client reaches to the server via HTTPS. I currently have a short-lived access token (JWT, stateless, 15 ...
user avatar
  • 101
0 votes
1 answer
181 views

Is there a risk involved in refreshing a JWT token every time you refocus the webpage?

I am currently testing a website that appears to make a refresh token request every time I focus away from the web browser and back, or away from the tab the website is open in and back to it. I've ...
user avatar
  • 173
0 votes
1 answer
123 views

How to encrypt REST body with openid connect OIDC

The big picture is: an android application which authenticate user with an external openid provider (such as azure AD) a Java EE server which expose rest endpoints securized with the validation of ...
user avatar
2 votes
1 answer
121 views

Extended expiration on JWT

When we are talking about JWT authentication, how big of a security risk would it be to eliminate the concept of a refresh token and just have a single JWT have an expiration time of, let's say 30 ...
user avatar
  • 457
0 votes
1 answer
227 views

Logout functionality with JWT Session tokens

As per my understanding, JWTs are signed tokens which can be used to identify users, if used as session tokens, they can eliminate need to store session on server ie. they are stateless. Suppose I ...
user avatar
0 votes
1 answer
154 views

Does "validating" a JWT token from prove authentication with OpenId?

I have a static react app which users login via an Okta SPA app. The app receives a JWT, which it is stored in the browser, and passed to the backend API via Authentication header on every request. ...
user avatar
  • 143
0 votes
2 answers
192 views

Is it bad practice or major security risk to cache decoded auth tokens in my backend?

I've set up a firebase passport strategy on a NestJS server which works fine, but I did not like the long load times it would incur on all requests that went through it. So I decided to cache decoded ...
user avatar
2 votes
0 answers
161 views

Is it a good practice to store both the Google Oauth2 access token and the refresh token in the database un hashed?

I recently came across a source code where they save a user's refresh token and the access token upon sign in through Google into the database. This is done to access the Google APIs later on through ...
user avatar
  • 121
1 vote
0 answers
117 views

Is masking JWT custom claims a good practice?

We use JWT tokens in our Rest API(Bank API) authentication with a normal payload like: { "user_id": "cdda338f-50e2-4e14-9f84-33b8a158db9f", "tenant_id": "...
user avatar
0 votes
1 answer
278 views

Am I handling JWT token correctly?

The app is divided into two parts, the fronted - written with the Angular framework and the backend, simple PHP files which handle the login, API calls, etc. My current flow is the following: User ...
user avatar
0 votes
0 answers
137 views

Authenticating for multiple services with a single JWT token (Single sign-on)

I am working on an authentication system using JWT bearer tokens. Currently every single service our company provides has it's own JWT sign key, but uses the same data structure for the token data. ...
user avatar
  • 101
0 votes
1 answer
129 views

JWT to prevent others from using video in their iframes

I just recently discovered JWT to secure my live stream and have done successful token on server and player but I think it still can be stolen. How I can use it to only have the domains I choose to be ...
user avatar
  • 1
1 vote
1 answer
180 views

Protecting a PWA authentication token on a public kiosk device

I have a use case where I need a factory-reset tablet device to install and run a simple Progressive Web Application (PWA). The tablet will be mounted on a wall inside a company building that may host ...
user avatar
  • 113
0 votes
0 answers
74 views

Correct implementation of a JWT signee

I tried implementing my own JWT logic, because I thought it would have some benefits for my use-case. Later I realized, that using the official JWT implementation is easier to use and more secure. But ...
user avatar
  • 1
0 votes
0 answers
93 views

How to restrict pages on React.js using JWT?

I'm using React.js (with react-router for serving content) for frontend with a golang backend. For the authentication I'm using JWT. But I've now stumbled upon a problem. How do I keep users from ...
user avatar
  • 35
0 votes
2 answers
709 views

Is there a downside to sending a refresh token on every request to an API?

Let's say that my user signs in and the server responds with a refresh token saved in a cookie (SameSite strict, HttpOnly, CSRF token too) and with the access token in response (saved in JS memory). I ...
user avatar
0 votes
1 answer
816 views

Implications of using a self-signed certificate to sign JWT tokens in OAuth

I'm looking to setup an integration between GitHub and Service Now and I can use OAuth2 using JWT Tokens, the steps to take can be found here. There is a specific step that states: Create a CA signed ...
user avatar
2 votes
1 answer
427 views

JWT : Should I check if user exists before validating token?

I am building an authentication service with python and flask and I use MongoDB to store user details. When a user sends a request on an API that enforce the authentication service, I get the token ...
user avatar
  • 123

1
2 3 4 5
8