Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [jwt]

A JSON Web Token (JWT) is a signed token provided by a server to a client which can be used to validate certain claims, e.g. identity, that can be used for a third party, e.g. a service provider.

0
votes
0answers
35 views

Is it ok to forward a JWT between two custom services?

I'm using Azure AD Implicit Flow for authentication between a SPA and a WebApi. I want to know if it would be ok/save to redirect from the SPA to a intermediary service of my own as well with the ...
3
votes
2answers
198 views
+100

Is this hybrid (cookie, jwt) authentication method for web applications known and practical?

I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
3
votes
0answers
36 views

Architecting a solution with native login and 3rd party login via OAuth/OpenID Connect using dotnet core

I am building an API driven application that will have a native login with username and password, and will also need to grant 3rd party access via OAuth/OpenID Connect in the near future. A pattern I ...
0
votes
1answer
49 views

Signing JWTs with server's SSL/TLS certificate

I have a server that needs to sign JWTs asymmetrically. I can either generate a new public/private keypair or re-use my keypair used for my server certificate. Is there any concern about re-using my ...
0
votes
1answer
38 views

Json Web Tokens with anonymous login

I have inherited an app that allows users to buy a gift card, and then see the gift card details after they have bought it. There are 4 main API calls - one to buy the gift card, one to get gift card ...
0
votes
1answer
38 views

Signing webhooks with asymmetric keys

I want to sign webhooks from my web service with a JSON Web Signature (part of JWT standard), ideally using asymmetric keys (so, using RSA or elliptic curve cryptography). What is the recommended or ...
0
votes
1answer
33 views

Why does thw JWT wordpress plugin recommend storing the token in a cookie/localstorage?

Reading about JWT I've come with a very interesting topic, which is the jwt tokens vulnerability if they're not properly secured when using with wordpress. So, the thing is that storing the token in ...
1
vote
1answer
571 views

Using hashcat in order to crack the JWT signature in WebGoat

I've recently started to practice my penetration testing skills and I got started with WebGoat. I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
0
votes
1answer
97 views

Securing protected routes/pages with JWT

Let's imagine I have a website with a React front-end that renders two pages, one is "View Data" and the other is a welcome page with a login form. Scenario: You log in and the server accepts it and ...
0
votes
1answer
144 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
5
votes
3answers
525 views

Is this password-less auth flow secure?

I'd like to implement a password-less auth flow for my mobile app that only requires a user clicking a link in their email to log in. Similar to how Slack handles auth. I'll be using node and jwt for ...
1
vote
1answer
290 views

Is this the correct way to use AWS Cognito?

I am doing the following in my React/Node App: Using the User Pools for a Cognito App that I have created Calling the /login endpoint with response_type=token in my React App Once I receive the JWT ...
1
vote
0answers
61 views

Do I need CSRF Protection? [duplicate]

I have a Rest API that is located at api.example.com. The user logs in at app.example.com and gets a Cookie which contains the authentication related information and handles the session. Every page ...
0
votes
2answers
899 views

JWT or session cookie for API for both web and mobile app?

I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach. The only two requirement are: I need to know the users that are ...
2
votes
0answers
46 views

Verifying the source of a request [duplicate]

I am currently writing a network multiplayer game that uses a lobby system to find available matches for players to join. The list of available matches is served and updated by a web application via a ...
1
vote
3answers
163 views

Recommended asymmetric algorithms for JWT?

I'm implementing JWT authentication for a new web service and am unsure which asymmetric algorithm to choose. I've searched around and haven't found any consensus or clear recommendations. According ...
4
votes
2answers
1k views

How to handle refresh tokens

I'm trying to wrap my head around JWT (JSON Web Token) based authentication for securing API endpoints using access tokens. I'm protecting these endpoints by requiring the user to have a valid access ...
1
vote
1answer
38 views

How does the authorization work after authentication using OpenID Connect

Suppose that a client gets an ID token and access token from the auth server after successful authentication. The client now sends a request to the application server (request contains access token ...
1
vote
0answers
187 views

Is this a secure implementation of JWT refresh tokens?

I am implementing a JWT refresh token and have developed the following way of refreshing tokens. The following is the program flow: When server retrieves login information, it checks against password ...
0
votes
1answer
158 views

Signing webhooks with JWT — overkill with TLS?

I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it ...
0
votes
0answers
52 views

How can a JWT token have multiple secrets?

I'm using the jwtcrack utility to attempt and crack an issued JWT token. I think just the following output should explain what's going on pretty well: [0] % ./jwtcrack [token] Secret is "P" joseph@...
0
votes
1answer
66 views

MQTT without TLS - prevent publish messages from unauthenticated devices

I have an use case where I'm not able to use MQTTS/TLS due to constraint on devices. Our plan is to perform authentication during MQTT CONNECT, passing a JWT token as a password. If I understand ...
3
votes
1answer
191 views

when should i use HMAC-based JWT?

I read a number of blog posts and found that it is tough to keep the secret-key a secret and if using a symmetric algorithm for JWT creation, the generator has the power to create as well as validate ...
1
vote
1answer
51 views

jwt in message payload?

My background is more onto SOAP, where we can do transport authentication and message authentication together. Basically we use http basic and SAML token in message payload. Regarding jwt, I have ...
3
votes
1answer
807 views

How to use Oauth2 and JWT to secure microservice architecture?

We have been investigating proper mechanism to secure microservises that we are going to provide as API endpoints via API manager application. Fundamentally we need stateless security mechanism like ...
2
votes
2answers
141 views

What's the benefit of JWT if user needs to send his credentials once anyway?

JWT tokens seem like a very good idea. You can send a request to some API without using your username/password secret pair. Still, I don't fully understand the benefits that it gives. I have two ...
3
votes
1answer
415 views

CSRF Protection Is Needed for GET Requests

I have a REST API that allows authenticated users to read data about their own account and make changes to their accounts. For authentication I use JWTs stored as httpOnly cookies. To protect against ...
1
vote
0answers
473 views

Should I hash my refresh tokens before storing them in the server's database? [duplicate]

I have a service with a client app (Mac). To log in, users enter their username and password in the client app, which sends this information to the server. The server verifies this information using ...
0
votes
1answer
356 views

JWT for authentication and authorization and protecting an API. It's feasible / secure?

I'm developing a web application which manages security and hygiene at work so the clients can access information about medical stuff, like exams, reports, accidents, ability to work, things like that....
0
votes
1answer
841 views

Amazon AWS KMS - Concept of signing in general and with JWT

Looking into Amazon AWS KMS (Key Management System). Got confused since the methods exposed via Amazon AWS API are only to encrypt and decrypt (https://docs.aws.amazon.com/kms/latest/APIReference/...
1
vote
1answer
1k views

Why does OpenID Connect (“OIDC”) use a `nonce` claim instead of the `jti` registered claim

According to the spec, OpenID Connect uses nonce as the registered claim name, but RFC 7519 already includes a registered claim named jti for this same purpose. Was this an oversight, or was there ...
5
votes
2answers
381 views

Is it safe to use a stateless authorization mechanism where the clear password is stored on the keychain?

Is it safe to use the following stateless authorization mechanism between a client (iOS & Android) and server? Sign up The client provides an email and password and saves the clear password on ...
2
votes
0answers
119 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
1
vote
2answers
521 views

JWT encoding using HMAC with asymmetric key as secret

I'm currently exploiting the vulnerability discussed here https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/ Where the algorithm type in JWT can be changed from ...
1
vote
1answer
292 views

JSON web token vulnerability with HMAC and RSA

I'm currently learning about a vulnerability that takes advantage of a JSON web token which is discussed here Though I understood the nature of the bug and how it can be abused by attackers, I couldn'...
2
votes
1answer
43 views

Implementing a custom stateless token

Normally i would use JWT when stateless auth is required, but i was thinking of a simple token system. Which will create a token while authenticating a user and then store that token in a SQL table ...
3
votes
0answers
2k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
3
votes
1answer
831 views

Authentication with JWT

I am building SPA (React/Redux) and require user authetification. I have found similar discussions, but haven't found answers for questions I outline below. Here are some options I found to implement: ...
2
votes
1answer
740 views

How to prevent refreshing a stolen access token

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
-1
votes
1answer
953 views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user id and unix timestamp. Now, I tried to use AES-128-GCM, ...
1
vote
1answer
1k views

Is storing a user id in JWT enough to verify the identity?

I have been thinking to try out JWT as an alternative to the old session based authentication for performance reasons (i.e. no additional SQL lookup for session id in database just to get the user id ...
3
votes
0answers
227 views

Do I need to use SAML and JWT for auth in SSO web app?

I am new to SAML authentication process so I am just trying to figure out if I understand it so I can try to integrate my web app (Angular/Nodejs) to an existing portal that currently uses SAML as ...
5
votes
0answers
148 views

JWT in localStorage with encrypted sessionId

What I want: Store a JWT in localStorage. The JWT contains claims about authorization. Prevent the JWT from being stolen and used by an attacker (using XSS) Avoid CSRF Storing the JWT in ...
4
votes
2answers
2k views

What should I use for authentication for my Django Rest API?

I just read this article about why JWT's suck. I'm now uncertain what I should use for authentication. For context: The API I wrote is mainly used by mobile Apps (iOS and Android). In the future it ...
1
vote
1answer
204 views

Encrypt a body instead of Signing it (with JWT for example)

What would be the issue if I encrypt the "claims/body/data" and I send it to the user, then when the user sends me this encrypted token, I decrypt it I trust it, and operate on the data in it (If it's ...
2
votes
1answer
109 views

Security concern for Single Sign On implementation

I'm trying to build a single sign on system that connects app A to B and B to A. Unfortunately, the option to use OpenID/OAuth/SAML is not possible right now, so I am building a basic solution myself, ...
0
votes
1answer
92 views

Server pagination with key in response to fetch next page

I want to introduce pagination in one of my server endpoints. The endpoint will have an option to include in the parameter the last index of the previous page, and if included, the "page" returned ...
3
votes
0answers
263 views

Concepts to support local and external authentication: JWT, Cookies, HttpOnly, …?

I am trying to figure out the correct authentication strategy and concepts for a single page web application (SPA) featuring local login as well as 3rd party login (e.g. Google, Auth0). Unfortunately, ...
3
votes
1answer
337 views

Is it safe to use jku, kid and x5u in JSON Web Signature (JWS) header?

I don't get what header parameters like jku, kid, x5u are for in JSON Web Signature (JWS). Since We have to verify the integrity of the content against secret key/public key, is it safe to leave jku, ...
4
votes
1answer
78 views

how is security maintained in session and JWT?

I have been using passport JS session for a long time without really caring about security concern. For next project I thought of replacing session with JWT but security related concerns arise as I ...