Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [jwt]

A JSON Web Token (JWT) is a signed token provided by a server to a client which can be used to validate certain claims, e.g. identity, that can be used for a third party, e.g. a service provider.

1
vote
1answer
89 views

Using hashcat in order to crack the JWT signature in WebGoat

I've recently started to practice my penetration testing skills and I got started with WebGoat. I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
0
votes
1answer
55 views

Securing protected routes/pages with JWT

Let's imagine I have a website with a React front-end that renders two pages, one is "View Data" and the other is a welcome page with a login form. Scenario: You log in and the server accepts it and ...
0
votes
1answer
73 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
5
votes
3answers
423 views

Is this password-less auth flow secure?

I'd like to implement a password-less auth flow for my mobile app that only requires a user clicking a link in their email to log in. Similar to how Slack handles auth. I'll be using node and jwt for ...
1
vote
1answer
105 views

Is this the correct way to use AWS Cognito?

I am doing the following in my React/Node App: Using the User Pools for a Cognito App that I have created Calling the /login endpoint with response_type=token in my React App Once I receive the JWT ...
1
vote
0answers
58 views

Do I need CSRF Protection? [duplicate]

I have a Rest API that is located at api.example.com. The user logs in at app.example.com and gets a Cookie which contains the authentication related information and handles the session. Every page ...
0
votes
2answers
376 views

JWT or session cookie for API for both web and mobile app?

I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach. The only two requirement are: I need to know the users that are ...
2
votes
0answers
44 views

Verifying the source of a request [duplicate]

I am currently writing a network multiplayer game that uses a lobby system to find available matches for players to join. The list of available matches is served and updated by a web application via a ...
1
vote
3answers
98 views

Recommended asymmetric algorithms for JWT?

I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
2
votes
2answers
355 views

How to handle refresh tokens

I'm trying to wrap my head around JWT (JSON Web Token) based authentication for securing API endpoints using access tokens. I'm protecting these endpoints by requiring the user to have a valid access ...
1
vote
1answer
34 views

How does the authorization work after authentication using OpenID Connect

Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token ...
1
vote
0answers
82 views

Is this a secure implementation of JWT refresh tokens?

I am implementing a JWT refresh token and have developed the following way of refreshing tokens. The following is the program flow: When server retrieves login information, it checks against password ...
0
votes
1answer
99 views

Signing webhooks with JWT — overkill with TLS?

I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it ...
0
votes
0answers
122 views

Can PASETO replace JWT for API authorization?

Has server symmetric-keyed PASETO been seriously evaluated as a viable candidate to replace JWT for API session authorization? JWT https://tools.ietf.org/html/rfc7519 https://jwt.io PASETO https:/...
0
votes
0answers
28 views

How can a JWT token have multiple secrets?

I'm using the jwtcrack utility to attempt and crack an issued JWT token. I think just the following output should explain what's going on pretty well: [0] % ./jwtcrack [token] Secret is "P" joseph@...
0
votes
1answer
44 views

MQTT without TLS - prevent publish messages from unauthenticated devices

I have an use case where I'm not able to use MQTTS/TLS due to constraint on devices. Our plan is to perform authentication during MQTT CONNECT, passing a JWT token as a password. If I understand ...
2
votes
0answers
52 views

when should i use HMAC-based JWT?

I read a number of blog posts and found that it is tough to keep the secret-key a secret and if using a symmetric algorithm for JWT creation, the generator has the power to create as well as validate ...
1
vote
0answers
35 views

jwt in message payload?

My background is more onto SOAP, where we can do transport authentication and message authentication together. Basically we use http basic and SAML token in message payload. Regarding jwt, I have ...
1
vote
1answer
195 views

How to use Oauth2 and JWT to secure microservice architecture?

We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application. Fundamentally we need stateless security mechanism like ...
0
votes
0answers
149 views

difference between res.header(x-auth, JWTtoken) and res.cookies(JWTtoken)?

I have seen across all blogs and articles is that there is two ways to handle JWTtokens, put them inside localStorage which subjected for XSS attack or put them inside Cookies and set httpOnly and ...
0
votes
0answers
197 views

Storing JWT in cookies vs Authorization: Bearer?

I don't want to store my JWT in localStorage due to XSS, so i want to know the difference between storing JWT in Cookies vs Auth Header
2
votes
2answers
109 views

What's the benefit of JWT if user needs to send his credentials once anyway?

JWT tokens seem like a very good idea. You can send a request to some API without using your username/password secret pair. Still, I don't fully understand the benefits that it gives. I have two ...
2
votes
1answer
279 views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...
0
votes
0answers
94 views

Role-based and multitenant authorisation via JWT?

First thing: let's put aside the debate on whether JWT should be used for managing sessions, I'm already aware of it and (at least some of) its limitations (invalidation, automatic prolongation of ...
0
votes
0answers
58 views

Microservices: JWT and Springboot

I'm developing a backend infrastructure based on microservices. I'm using Springboot framework. Regarding the authentication and authorization phases, I would use Oauth2 + JWT. That's mainly because ...
1
vote
0answers
291 views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
0
votes
1answer
259 views

JWT for authentication and authorization and protecting an API. It's feasible / secure?

I'm developing a web application which manages security and hygiene at work so the clients can access information about medical stuff, like exams, reports, accidents, ability to work, things like that....
0
votes
1answer
565 views

Amazon AWS KMS - Concept of signing in general and with JWT

Looking into Amazon AWS KMS (Key Management System). Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/...
1
vote
1answer
684 views

Why does OpenID Connect (“OIDC”) use a `nonce` claim instead of the `jti` registered claim

According to the spec, OpenID Connect uses nonce as the registered claim name, but RFC 7519 already includes a registered claim named jti for this same purpose. Was this an oversight, or was there ...
5
votes
2answers
307 views

Is it safe to use a stateless authorization mechanism where the clear password is stored on the keychain?

Is it safe to use the following stateless authorization mechanism between a client (iOS & Android) and server? Sign up The client provides an email and password and saves the clear password on ...
2
votes
0answers
103 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
1
vote
2answers
403 views

JWT encoding using HMAC with asymmetric key as secret

I'm currently exploiting the vulnerability discussed here https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ Where the algorithm type in JWT can be changed from ...
1
vote
1answer
238 views

JSON web token vulnerability with HMAC and RSA

I'm currently learning about a vulnerability that takes advantage of a JSON web token which is discussed here Though I understood the nature of the bug and how it can be abused by attackers, I couldn'...
2
votes
1answer
41 views

Implementing a custom stateless token

Normally i would use JWT when stateless auth is required, but i was thinking of a simple token system. Which will create a token while authenticating a user and then store that token in a SQL table ...
3
votes
0answers
1k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
3
votes
1answer
594 views

Authentication with JWT

I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement: ...
0
votes
0answers
24 views

Mobile apps AUTH flow

When the user enters username and password into an mobile app( iOS ,Android or windows app)it calls a thirds party oAuth login web service which responds back with oAuth access token and refresh token....
2
votes
1answer
511 views

How to prevent refreshing a stolen access token

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
-1
votes
1answer
721 views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user id and unix timestamp. Now, I tried to use AES-128-GCM, ...
1
vote
1answer
924 views

Is storing a user id in JWT enough to verify the identity?

I have been thinking to try out JWT as an alternative to the old session based authentication for performance reasons (i.e. no additional SQL lookup for session id in database just to get the user id ...
3
votes
0answers
190 views

Do I need to use SAML and JWT for auth in SSO web app?

I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...
3
votes
0answers
109 views

JWT in localStorage with encrypted sessionId

What I want: Store a JWT in localStorage. The JWT contains claims about authorization. Prevent the JWT from being stolen and used by an attacker (using XSS) Avoid CSRF Storing the JWT in ...
4
votes
2answers
1k views

What should I use for authentication for my Django Rest API?

I just read this article about why JWT's suck. I'm now uncertain what I should use for authentication. For context: The API I wrote is mainly used by mobile Apps (iOS and Android). In the future it ...
1
vote
1answer
148 views

Encrypt a body instead of Signing it (with JWT for example)

What would be the issue if I encrypt the "claims/body/data" and I send it to the user, then when the user sends me this encrypted token, I decrypt it I trust it, and operate on the data in it (If it's ...
2
votes
1answer
103 views

Security concern for Single Sign On implementation

I'm trying to build a single sign on system that connects app A to B and B to A. Unfortunately, the option to use OpenID/OAuth/SAML is not possible right now, so I am building a basic solution myself, ...
0
votes
1answer
83 views

Server pagination with key in response to fetch next page

I want to introduce pagination in one of my server endpoints. The endpoint will have an option to include in the parameter the last index of the previous page, and if included, the "page" returned ...
3
votes
0answers
220 views

Concepts to support local and external authentication: JWT, Cookies, HttpOnly, …?

I am trying to figure out the correct authentication strategy and concepts for a single page web application (SPA) featuring local login as well as 3rd party login (e.g. Google, Auth0). Unfortunately, ...
3
votes
1answer
248 views

Is it safe to use jku, kid and x5u in JSON Web Signature (JWS) header?

I don't get what header parameters like jku, kid, x5u are for in JSON Web Signature (JWS). Since We have to verify the integrity of the content against secret key/public key, is it safe to leave jku, ...
4
votes
1answer
67 views

how is security maintained in session and JWT?

I have been using passport JS session for a long time without really caring about security concern. For next project I thought of replacing session with JWT but security related concerns arise as I ...
2
votes
0answers
104 views

Wanted: Secure login/authentication strategy for website with AND without JavaScript in 2018

I am trying to figure out a strategy for secure authentication - without re-inventing the wheel, but also considering the specific constraints of my situation. The strategy should not be tied to a ...