Questions tagged [jwt]

A JSON Web Token (JWT) is a signed token provided by a server to a client which can be used to validate certain claims, e.g. identity, that can be used for a third party, e.g. a service provider.

Filter by
Sorted by
Tagged with
1
vote
1answer
34 views

Having problems with performing a JWT “none” algorithm attack

I'm taking a course where I must breach a site which uses 2015 version of JWT for authentication. They gave me the test//test login information and I must login with admin. After I log in, I receive ...
3
votes
0answers
98 views

Why is a JWT split into three dot-delimited parts? [migrated]

A JSON Web Token (JWT) is split into three Base-64-encoded parts, which are concatenated by periods ("."). The first two parts encode JSON objects, the first of which is a header detailing the ...
0
votes
1answer
53 views

Having a JWT that doesn't expire

I'm trying to understand why having a JWT access token that doesn't expire is bad for my application. The way I have written my backend, when the JWT comes in, I verify it and extract the subject ...
0
votes
0answers
25 views

The benefit of JWT refresh token if authorization and resource server are merged?

Is there any benefit in using refresh tokens if your auth and resource server are combined? I understand the benefit when they are separate: The refresh token is never sent to the resource server, ...
0
votes
2answers
78 views

Alternative to using Refresh Tokens?

I've been learning about OAuth2, JWT tokens, and refresh tokens. My understanding of this is: A user logs in using their credentials. They are given back an access token (short-lived) and a refresh ...
0
votes
1answer
57 views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
31
votes
3answers
4k views

Should I be able to see patterns in a HS256 encoded JWT?

I was fiddling with https://jwt.io/ using this header { "alg": "HS256", "typ": "JWT" } when I realized that replacing the payload name with something repetitive like AAAAAAAAAAAAAAAAAAAA would ...
0
votes
1answer
108 views

Is this private network authentication system secure?

I am building an authentication system to be used within a company's private network. I do not administer this network, and I know very little about the setup, but my basic understanding is you must ...
1
vote
0answers
43 views

JWT scheme with different signing algorithms

I'm planning to implement a (slightly non-standard?) JWT authentication scheme with refresh and access tokens, in which refresh and access tokens use different signing algorithms: refresh token uses ...
1
vote
2answers
113 views

JWT(Json Web Token) Tampering

I'm reading OWASP Top 10 - 2017 The Ten Most Critical Web Application Security Risks, and came across the following risk, under Broken Access Control vulnerabilities: Metadata manipulation, such as ...
0
votes
1answer
48 views

How do I get the “n” (modulus) field in the jwk response

We have a web-service that follows RFC 7515 / JWT: it supplies public keys on a /jwt endpoint and encodes data transferred on its main endpoints into JOSE+JSON. Using several standard JAVA libraries ...
0
votes
2answers
42 views

JWT vs custom encryption for REST APIs over https

For our REST API architecture, we are currently thinking over two options - Json Web Token - pros are that it is industry standard, we pass a key which adds a layer of access control and using which ...
0
votes
1answer
59 views

JWT: In a server-to-server request, should I sign the entire request body?

Let's set the scene with two servers: an "auth" server which provides users with authorization tokens containing claims relevant to their account a "paywall" server, which after receiving payment ...
0
votes
1answer
50 views

Extract data from burp response and use in another request

I have a scenario where I need to call /api/login to get a token and then use said token in subsequent calls until it expires. Is there a way to automate the call and token extraction and then to ...
1
vote
2answers
64 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
0
votes
1answer
53 views

Validating iss and aud for internally signed JWT

I have an identity service that issues JWTs that are signed with private key. I have several resource services that consume that token to determine the claims of the user and thereby to determine ...
0
votes
0answers
86 views

Understanding JWT and SSO

I'm having trouble understanding how to set up SSO between my app and another app we have deployed. I'm new to trying to set this kind of thing up, so I was hoping someone could explain whether I'm on ...
4
votes
4answers
278 views

Generate API keys with JWT and regenerate the same key when needed

I recently found my self in need of developing a public API for my application. I developed my application with node.js and MongoDB. After some research, I decided to use jwt for generating API keys ...
1
vote
0answers
67 views

Do I have to store refresh token in database?

If I generate refresh tokens with expire time of 14 days, do I have to store them in my database and compare them when an access token is renewed, or verifying them (with jwt library) is enough? Also, ...
0
votes
1answer
60 views

JSON Web Encryption (JWE): should one verify the alg and enc similarly to JWS alg whitelisting?

Use of JWS may suffer from flaws when relying on the "alg" attribute as described here: Critical vulnerabilities in JSON Web Token libraries. The advice is to verify that the signing JWS algorithm is ...
0
votes
0answers
53 views

Potential problems not verifying the JWT signature if wrapped in another JWT depending on HTTPS

Say that we have an authentication system that generates JWT to authenticate users to other systems. This JWT contains an inner token that can be made by multiple IDP's. The signature of this JWT is ...
1
vote
1answer
118 views

How to send authentication token via SMS for a REST API

I want to call my REST API with encrypted SMS(with some intermediate server and a shared key by client and server which is transmitted via SSL), I have problem with sending requests that need ...
0
votes
1answer
49 views

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com. I employ a double-submit verification strategy. The backend has protected ...
3
votes
3answers
312 views

Should a logout request be authenticated?

I have implemented access tokens and refresh tokens, without an auth server (my API server also does authentication). Access tokens: stored in the client (localstorage). Expire in 20 minutes. Refresh ...
1
vote
1answer
86 views

Securing a Node.js REST API for React.js webapp as well as a standalone API

I'm trying to create a secure method of authentication for my Node.js REST API that will work both for direct API requests as well as from my React.js web application. I've done some reading on how to ...
0
votes
1answer
47 views

Why do we need token authentication?

If I'm creating an authorization service for my application, why can't I just hash the password and save the the username and hashed password in my User table? Why should I use a token authentication ...
0
votes
2answers
74 views

What is the most secure way to store cross subdomain cookies

I am working for a company we will call "Company x". This company has a domain companyx.com. They have a cloud platform that manages things like SSL, but in order to do this you are required to use ...
0
votes
0answers
56 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
4
votes
0answers
86 views

Should I create a JWT on one server, and verify it on a different server?

So lets say I have 2 microservices: 1). A serverless / lambda function, triggered by some hardware event 2). A websocket server, to handle some data I want to ensure that only authenticated ...
0
votes
0answers
23 views

One JWT with different levels of permissions

I'm using JSON Web Token's to authenticate users. I have 2 types of tokens: 1/ basic token - no expiry, includes an embedded userAccessId(which is a guid) 2/ advanced token - expiry is 5 mins, ...
0
votes
2answers
69 views

Are JWT's the way to go in my situation?

I am working on a personal project for learning reasons, and have come to the point of authenticating and authorizing users. I would like to keep the project as stateless as possible, to make sure it ...
1
vote
2answers
94 views

Should Google User ID's be hashed when stored in the database

I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods. I'm basically treating the Google ID and Password as credentials here. I'm already ...
0
votes
1answer
62 views

How to authorize access to a resource when requested with CORS and validate the origin?

I'll try to make the explanation simple and to the point (keyword try). And if that's not sufficient, then maybe I can expand on the question. Imagine two sites: resources.example.com and www.example....
0
votes
1answer
87 views

Is it possible to verify the requesting user for a REST transaction secured by JWT at a later date?

I have a React (Javascript) single-page application that authenticates users via username/password/MFA to Keycloak, receives a signed JWT upon successful authentication, and then uses that JWT to call ...
0
votes
1answer
592 views

Is it safe to store the token expiration time in local storage?

I understand why one shouldn't store the contents of the JWT token client-side but what about just storing the token expiration time? I'm using the auth0 authentication service in my app and I'd like ...
0
votes
3answers
113 views

Why is passing a token for each API request more secure than passing a username and secret for each API request?

I guess this could also be phrased as JWT vs. Basic Auth, similar idea? Passing a token for each API request seems to be the more common and recommended approach, and I have the gut feeling that it ...
0
votes
0answers
36 views

Store secret for HS256 (JWT) in repository?

For JWT generation in my Java application I need to use the secret. Thus, I need to include this along with other source code into repository, which is a no-no. So how can I store the secret in ...
1
vote
1answer
77 views

Can I use a JWT for both Authentication & Data Transmission

I think I have a high level understanding of what a JWT is and how it works. I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing ...
3
votes
2answers
360 views

JWT: Why is audience important?

JWTs typically include an audience claim. I've read in many places (articles, code examples, the spec itself) that you must check that the token is intended for you and not another audience. I'm ...
0
votes
0answers
41 views

what would be the best approach to generate JWT token for server to server communications?

I am planning to develop an authentication service which generates and validates the JWT token for incoming requests. What would be the best challenge mechanism which could be employed to generate the ...
1
vote
2answers
1k views

Storing JWT in SPA

I'm working on my first application and I was sending both access and refresh token (jwt) in the response as I've learned before but the frontend developer does not really know where it can be stored ...
2
votes
2answers
244 views

Is localStorage a security liability for JWTs?

I'm using JSON web tokens for authentication in my app. Since data is pulled from protected routes in the API, security tokens are stored in the frontend. My question is this: Is using HTML's ...
1
vote
0answers
70 views

What is a gain from storing jws token in database

Recently someone mentioned he is using JWS token for authorisation, but JWS tokens received via API calls are validated against active ones stored in database. (EDIT he also checks signature). In my ...
0
votes
1answer
274 views

Security issues with using JWT + cookies for session authentication?

Trying to get my head around not using traditional $_SESSIONS to keep user logged-in across pages. Are there security issues with storing JWT in cookies to authenticate a user session? Here's a bare ...
1
vote
0answers
55 views

Proper implementation of JWT authentication in mobile app

I'm building a mobile app that connects to a Python Flask API and backend. Currently, I am using JWTs for authentication. The expiration of the token is set to be 6 months in advance. The thing ...
0
votes
1answer
99 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
0
votes
0answers
73 views

Multiple authentication servers providing authorization to resource server

What I want to achieve? To authorize people to single resource server over multiple different Authentication servers. Clients want to login via their own Domain credentials and have credentials only ...
0
votes
0answers
37 views

Bind application user roles to JWT is good

I need implement service oriented application. so i hope to use micro services for my back end function and react for fronted end development. for session management i hope to use JWT tokens. with ...
1
vote
1answer
707 views

Why should I use jwt in Refresh Token? [duplicate]

I use Refresh Token to handling expired Access Token, and in log out, I can remove Refresh Token from the database. Refresh Token must never expire (not sure) because the user can check "remember me". ...
0
votes
0answers
87 views

How long should a JWT token be valid for mobile application

I am testing a mobile web application. The application uses JWT token for login (authentication). When I log in application sends the following request: POST /api/authenticate HTTP/1.1 Content-Type: ...