Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [jwt]

A JSON Web Token (JWT) is a signed token provided by a server to a client which can be used to validate certain claims, e.g. identity, that can be used for a third party, e.g. a service provider.

0
votes
0answers
21 views

Is it possible to verify the requesting user for a REST transaction secured by JWT at a later date?

I have a React (Javascript) single-page application that authenticates users via username/password/MFA to Keycloak, receives a signed JWT upon successful authentication, and then uses that JWT to call ...
0
votes
1answer
109 views

Is it safe to store the token expiration time in local storage?

I understand why one shouldn't store the contents of the JWT token client-side but what about just storing the token expiration time? I'm using the auth0 authentication service in my app and I'd like ...
0
votes
3answers
69 views

Why is passing a token for each API request more secure than passing a username and secret for each API request?

I guess this could also be phrased as JWT vs. Basic Auth, similar idea? Passing a token for each API request seems to be the more common and recommended approach, and I have the gut feeling that it ...
0
votes
0answers
30 views

Store secret for HS256 (JWT) in repository?

For JWT generation in my Java application I need to use the secret. Thus, I need to include this along with other source code into repository, which is a no-no. So how can I store the secret in ...
1
vote
1answer
59 views

Can I use a JWT for both Authentication & Data Transmission

I think I have a high level understanding of what a JWT is and how it works. I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing ...
1
vote
2answers
119 views

JWT: Why is audience important?

JWTs typically include an audience claim. I've read in many places (articles, code examples, the spec itself) that you must check that the token is intended for you and not another audience. I'm ...
0
votes
0answers
34 views

what would be the best approach to generate JWT token for server to server communications?

I am planning to develop an authentication service which generates and validates the JWT token for incoming requests. What would be the best challenge mechanism which could be employed to generate the ...
0
votes
2answers
97 views

Storing JWT in SPA

I'm working on my first application and I was sending both access and refresh token (jwt) in the response as I've learned before but the frontend developer does not really know where it can be stored ...
0
votes
1answer
44 views

Is localStorage a security liability for JWTs?

I'm using JSON web tokens for authentication in my app. Since data is pulled from protected routes in the API, security tokens are stored in the frontend. My question is this: Is using HTML's ...
1
vote
0answers
64 views

What is a gain from storing jws token in database

Recently someone mentioned he is using JWS token for authorisation, but JWS tokens received via API calls are validated against active ones stored in database. (EDIT he also checks signature). In my ...
0
votes
1answer
62 views

Security issues with using JWT + cookies for session authentication?

Trying to get my head around not using traditional $_SESSIONS to keep user logged-in across pages. Are there security issues with storing JWT in cookies to authenticate a user session? Here's a bare ...
1
vote
0answers
31 views

Proper implementation of JWT authentication in mobile app

I'm building a mobile app that connects to a Python Flask API and backend. Currently, I am using JWTs for authentication. The expiration of the token is set to be 6 months in advance. The thing ...
0
votes
1answer
72 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
0
votes
0answers
33 views

Multiple authentication servers providing authorization to resource server

What I want to achieve? To authorize people to single resource server over multiple different Authentication servers. Clients want to login via their own Domain credentials and have credentials only ...
0
votes
0answers
33 views

Bind application user roles to JWT is good

I need implement service oriented application. so i hope to use micro services for my back end function and react for fronted end development. for session management i hope to use JWT tokens. with ...
1
vote
1answer
165 views

Why should I use jwt in Refresh Token? [duplicate]

I use Refresh Token to handling expired Access Token, and in log out, I can remove Refresh Token from the database. Refresh Token must never expire (not sure) because the user can check "remember me". ...
0
votes
0answers
51 views

How long should a JWT token be valid for mobile application

I am testing a mobile web application. The application uses JWT token for login (authentication). When I log in application sends the following request: POST /api/authenticate HTTP/1.1 Content-Type: ...
1
vote
1answer
83 views

Store user credentials vs store refresh token

I am currently designing a native mobile application that require user authentication and authorization to connect to a REST API. Keycloak will be used as IAM tool and tokens will be JWT. I don't ...
2
votes
2answers
145 views

Rest API Authentication with JWT

This is my first time working with JWTs so I decided to ask here on Information Security as I'm very unsure about my approach towards JWT Authentication. I'm currently working on an API that will ...
1
vote
0answers
38 views

Is having multiple access tokens valid at the same time a security risk?

I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time. Is this a potential ...
0
votes
0answers
33 views

Share generated private/public pair among instances of same application

I've been working on a login system which works with JWT. Nothing fancy, you send a valid pair user+password and then you get a signed token to identify yourself on further requests. It is build on ...
0
votes
0answers
37 views

Is it ok to forward a JWT between two custom services?

I'm using Azure AD Implicit Flow for authentication between a SPA and a WebApi. I want to know if it would be ok/save to redirect from the SPA to a intermediary service of my own as well with the ...
3
votes
2answers
265 views

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
3
votes
0answers
40 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
0
votes
1answer
71 views

Signing JWTs with server's SSL/TLS certificate

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my ...
0
votes
1answer
82 views

Json Web Tokens with anonymous login

I have inherited an app that allows users to buy a gift card, and then see the gift card details after they have bought it. There are 4 main API calls - one to buy the gift card, one to get gift card ...
0
votes
2answers
71 views

Signing webhooks with asymmetric keys

I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography). What is the recommended or ...
0
votes
1answer
60 views

Why does thw JWT wordpress plugin recommend storing the token in a cookie/localstorage?

Reading about JWT I've come with a very interesting topic, which is the jwt tokens vulnerability if they're not properly secured when using with wordpress. So, the thing is that storing the token in ...
1
vote
1answer
1k views

Using hashcat in order to crack the JWT signature in WebGoat

I've recently started to practice my penetration testing skills and I got started with WebGoat. I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
0
votes
1answer
138 views

Securing protected routes/pages with JWT

Let's imagine I have a website with a React front-end that renders two pages, one is "View Data" and the other is a welcome page with a login form. Scenario: You log in and the server accepts it and ...
0
votes
1answer
206 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
6
votes
3answers
658 views

Is this password-less auth flow secure?

I'd like to implement a password-less auth flow for my mobile app that only requires a user clicking a link in their email to log in. Similar to how Slack handles auth. I'll be using node and jwt for ...
1
vote
1answer
657 views

Is this the correct way to use AWS Cognito?

I am doing the following in my React/Node App: Using the User Pools for a Cognito App that I have created Calling the /login endpoint with response_type=token in my React App Once I receive the JWT ...
0
votes
2answers
2k views

JWT or session cookie for API for both web and mobile app?

I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach. The only two requirement are: I need to know the users that are ...
2
votes
0answers
48 views

Verifying the source of a request [duplicate]

I am currently writing a network multiplayer game that uses a lobby system to find available matches for players to join. The list of available matches is served and updated by a web application via a ...
1
vote
3answers
338 views

Recommended asymmetric algorithms for JWT?

I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
7
votes
2answers
2k views

How to handle refresh tokens

I'm trying to wrap my head around JWT (JSON Web Token) based authentication for securing API endpoints using access tokens. I'm protecting these endpoints by requiring the user to have a valid access ...
1
vote
1answer
39 views

How does the authorization work after authentication using OpenID Connect

Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token ...
1
vote
0answers
241 views

Is this a secure implementation of JWT refresh tokens?

I am implementing a JWT refresh token and have developed the following way of refreshing tokens. The following is the program flow: When server retrieves login information, it checks against password ...
0
votes
1answer
214 views

Signing webhooks with JWT — overkill with TLS?

I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it ...
0
votes
0answers
82 views

How can a JWT token have multiple secrets?

I'm using the jwtcrack utility to attempt and crack an issued JWT token. I think just the following output should explain what's going on pretty well: [0] % ./jwtcrack [token] Secret is "P" joseph@...
0
votes
1answer
87 views

MQTT without TLS - prevent publish messages from unauthenticated devices

I have an use case where I'm not able to use MQTTS/TLS due to constraint on devices. Our plan is to perform authentication during MQTT CONNECT, passing a JWT token as a password. If I understand ...
4
votes
1answer
334 views

when should i use HMAC-based JWT?

I read a number of blog posts and found that it is tough to keep the secret-key a secret and if using a symmetric algorithm for JWT creation, the generator has the power to create as well as validate ...
1
vote
1answer
59 views

jwt in message payload?

My background is more onto SOAP, where we can do transport authentication and message authentication together. Basically we use http basic and SAML token in message payload. Regarding jwt, I have ...
3
votes
1answer
2k views

How to use Oauth2 and JWT to secure microservice architecture?

We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application. Fundamentally we need stateless security mechanism like ...
2
votes
2answers
222 views

What's the benefit of JWT if user needs to send his credentials once anyway?

JWT tokens seem like a very good idea. You can send a request to some API without using your username/password secret pair. Still, I don't fully understand the benefits that it gives. I have two ...
3
votes
1answer
570 views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...
2
votes
0answers
648 views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
0
votes
1answer
432 views

JWT for authentication and authorization and protecting an API. It's feasible / secure?

I'm developing a web application which manages security and hygiene at work so the clients can access information about medical stuff, like exams, reports, accidents, ability to work, things like that....
0
votes
1answer
1k views

Amazon AWS KMS - Concept of signing in general and with JWT

Looking into Amazon AWS KMS (Key Management System). Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/...