Questions tagged [jwt]

A JSON Web Token (JWT) is a signed token provided by a server to a client which can be used to validate certain claims, e.g. identity, that can be used for a third party, e.g. a service provider.

Filter by
Sorted by
Tagged with
0
votes
0answers
31 views

In memory JWT for API auth with HTTP-only cookie for sessions?

I've spent a while reading about this, and I know it's a common topic, but I was hoping to get some feedback on my authentication approach. I have an SPA. It needs to authenticate to 1) my ...
0
votes
1answer
37 views

Should OIDC introspection endpoint be used to validate the JWT access token?

My resource server exposes an API that expects JWT access tokens obtained using OpenID Connect. So far the validation in the resource server side consisted on using the Realm public key to validate ...
0
votes
1answer
45 views

Using Refresh Token inside of Access Token without HTTPS

I previously read that Access Token must be sent with every request to the API but Refresh Token must be sent ONLY when the Access Token expires. I'm trying to use a similar model to the conventional ...
2
votes
1answer
61 views

Is using the JWT token to perform queries, as opposed to a raw value in its payload, considered a good practice?

For my SPA app, I'm using Firebase as the authentication provider. I'm also using this token to authenticate with my back-end server. The Firebase documentation reads: "Warning: Do not accept ...
0
votes
0answers
15 views

jwt served via httponly cookie with someway to find out is-logged-in [migrated]

While building a javascript SPA (single page application) I need to display some pages differently based on if the user is logged in or not. Auth is handled by JWT which is served via httpOnly ...
1
vote
1answer
51 views

How to ensure JWT security in authentication?

I have implemented a backend as a REST API. To maintain the statelessness in REST, I intend to use JWT to verify that that a user has logged in or not. (A user is logged in if a valid token is present ...
1
vote
1answer
44 views

How to implement “Enter Password to Continue” for a page in a stateless application which uses JWTs?

In my application I want a page to be accessible to the user only after s/he has entered the password again to prevent someone else opening that page in case the user has left a logged-in device open. ...
0
votes
1answer
48 views

Authentication for server to server api

I want to design an api which an organization is going to use to connect with my server. For a client-server application, a simple jwt-based authentication is done by verifying user credential and ...
0
votes
1answer
128 views

Is it safe to assume that a JWT is valid if the library says so?

This is my first time using JWT. I'm using the jwcrypto library as directed, and the key I'm using is an RSA key I generated with OpenSSL. My initial inclination was to store the JWT in the database ...
1
vote
1answer
56 views

Double JWT submit method

I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature. The header & payload is stored in a separate ...
0
votes
1answer
43 views

JWT with a single audience claim accessing a resource server with multiple configured audience values

When a JWT id_token with a single audience is presented to a resource server which has multiple configured audience values, should the resource server reject the validity of the token on the basis of ...
0
votes
3answers
122 views

Admin privileges depending on JWT body

From a security perspective is it ok to store the permissions of a user inside the body of the Json Web Token? For example a jwt body like this: { "username": "lukas", "isAdmin": true } The ...
1
vote
0answers
61 views

Does this two-token scheme work?

Security noob here. I've been trying to figure out how to secure my web app from both CSRF and XSS. It's a single-page app that talks to a JSON API on the server side. I'm trying not to do a roll-...
0
votes
2answers
49 views

How to log admin in as regular user? [webdev]

I'm using JWTs for authentication. It would be good as a means of double checking the user's experience if an admin user could log in as a regular user. One way I thought to implement this could be ...
0
votes
0answers
31 views

JWT in GraphQL GET Request via AJAX

I have a SPA (Single Page Application) that receives and updates information about the logged in user from the API using an AJAX request. However, the requests are authorized using a JWT (JSON Web ...
0
votes
1answer
85 views

Allowing clients to authenticate by generating their own JWT

I am trying to achieve an authentication system that: Has short-lived passwords/tokens (unlike Basic Auth or Api key), Won't expose users credentials if my users table is leaked (unlike HMAC), Every ...
0
votes
4answers
99 views

Is a security flaw created in extending TLS to bind and propagage a client-side JWT?

Apart from the fact that TLS doesn't have "connection context" variables, is there any reason why this couldn't be technically built into the standard for something like JWT? Why it is needed When a ...
1
vote
0answers
43 views

Validating JWT in server-to-auth-server scenario

The main question here is: If you are using a backend server to authenticate a user with a third party provider such as Auth0, do you need to validate the JWT received in this scenario? I am looking ...
3
votes
1answer
134 views

Should JWT's be validated on every request?

I have been unable to find a definitive answer to the above question. We currently use JWTs from AWS Cognito for our Authentication. Currently the JWTs that are returned are too large to use in ...
2
votes
1answer
185 views

OAuth2: Where should I store my refresh token in a stateless application?

In my current architecture I have an authentication server which provides a JWT token via OpenID Connect to any web application that uses the code flow I implemented. I went to the hassle of ...
0
votes
1answer
64 views

jwt symmetric signature security risks (from client side)

I am currently implementing an iOS app, which integrates with a cloud hosted .net backend system in azure, which. The api login endpoint takes user/pass -> replies with an signed only HS256 jwt token....
0
votes
2answers
80 views

JWT token authorize and authenticate

I have created a service that takes login credentials and gives back a JWT. Now the JWT is created with a secret key from this service. I would like to use this token to get access from other micro-...
1
vote
1answer
74 views

Preventing jwt replay attacks against the client-side

I already read good answers about preventing replay attacks with JWT and a lot of resources like jwt.io. The conclusion was that I needed to use the jti claim. From: Can I prevent a replay attack of ...
0
votes
0answers
47 views

Is this jwt access and refresh tokens logic/structure secure?

User logs in User gets a refresh_token assigned and stored in the database (long lived 7d) Client receives an accestoken (Short lived, 2h), and stores it as a cookie. Client also receives the userId ...
1
vote
1answer
54 views

Public Digital Signature Validation with JWE

After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, ...
1
vote
1answer
78 views

Is encrypting localStorage data more secure?

I'm building an SPA app and I have to use an access token to make requests to an API. The most common way to store the JSON Web Tokens is to use localStorage, but I have always thought that was a bad ...
2
votes
1answer
130 views

What is the point of the payload in reset password API with JWT

I am trying to write an API that allows the user to reset their password via their email. I have been following https://www.smashingmagazine.com/2017/11/safe-password-resets-with-json-web-tokens/, ...
1
vote
1answer
319 views

How to invalidate JWT tokens without a database lookup with each request to the server?

JWT Bearer token and stateless REST API question I am implementing a stateless REST API. I am used to using sessions built into frameworks or 0Auth but now I am in the process of developing my own ...
0
votes
1answer
81 views

oidc authentication webapp REST api

So I have looked at the following client library, implementing the OpenID Connect spec: https://github.com/IdentityModel/oidc-client-js It works as expected, and I can now allow users to login with ...
4
votes
1answer
141 views

Zero trust across micro-services using JWT

I am planning to implement JWT authentication on my micro-services to achieve zero trust architecture. User will generate a JWT token through front end micro-service. Each subsequent request will ...
2
votes
0answers
54 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
0
votes
0answers
55 views

SAML Passing a JWT token from the API to the SPA application

We are trying to implement the SAML 2.0 protocol and I stumbled upon a problem related to passing the token from the API to the client SPA application. The authentication flow goes like this, the ...
1
vote
2answers
25 views

Viability of simplified JWT

Our team has been building a custom distributed authentication mechanism, and I wanted to ask if this approach is actually viable. The approach is a dumbed down version of Jason Web Token (JWT). ...
2
votes
2answers
204 views

JWT Token Stored in /data/data/<app>/shared_prefs - Android App

I am testing an Android application I am creating for learning purposes (I am using a pre-existing skeleton code my friend gave me). The application uses firebase and stores the JWT token in an xml ...
17
votes
3answers
5k views

Storing info in JWT payload

Currently, the access token expires in 15 minutes and the only info stored in the payload is the user id. Each user has a balance which he can use inside the app. Should I query the database on each ...
1
vote
1answer
62 views

How verify id_token from the browser in OAuth2?

I have been dwelling into OAuth2 and and OpenID Connect for Authorization flow. And I'm still a bit confused. I do understand that during the code exchange for an access token the user receives an ...
0
votes
1answer
102 views

How can user-less servers be authenticated without sharing secret data?

Background: This is the architecture of the platform I'm working on: The API has several secured endpoints for accessing the database. Users login on the Front End with their credentials, and if ...
1
vote
1answer
71 views

Carrying two authorization tokens in a request

In my group we have been asked to implement an authentication-authorization flow in a new web portal that lives in a complex infrastructure. For historical reason the initial authentication of each ...
2
votes
1answer
77 views

Is it OK practice to use the same public and private keys for TLS and to generate JWTs?

. . . Or is that discouraged, and it's better to use separate key pairs for TLS and JWT? (It would be slightly easier to manage one key pair only, but probably better security to use two separate key ...
3
votes
0answers
45 views

Is this JWT/JWS authentication scheme missing anything important to security? [Educational Question Only]

I'm using the following authentication scheme for my current MERN project. I'd like to know if it's secure, particularly the renewal approach (more details after the description). User signs in over ...
3
votes
2answers
126 views

Is this security scheme using passwords, short-lived access JWTs, and long-lived refresh tokens a good way to secure a REST API?

I'm trying to secure a REST API that I'm using as a backend for a single-page application. The API provides access to read/create/modify/delete protected resources, based on a set of permissions ...
2
votes
1answer
233 views

JWT: Choosing between HMAC and RSA

It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 ...
2
votes
1answer
158 views

Security Risk of Stolen Session ID vs Authentication Token

I was intrigued by the discussion of this SO question as well as the accompanying blog post. I'm trying to better understand the mechanics of the two systems, and one of the questions I came up with ...
6
votes
2answers
228 views

Usefulness of token sidejacking prevention mentioned by OWASP JWT Cheat Sheet

I was just reading through the "Token sidejacking" of the JWT Cheat Sheet of OWASP (https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html#token-sidejacking) At the ...
2
votes
1answer
108 views

Is this schema between a Desktop App and an API secure?

From my previous question: How secure is this schema between a Desktop App (c++) and an API (php). Introduction I made a paid Desktop-app that required constant internet connection (because of its ...
1
vote
1answer
100 views

How secure is this schema between a Desktop App (c++) and an API (php)

as title says I'm writing a paid Desktop App that automates some process, it indirectly requires internet connection because MY app automates another Desktop app that requires internet connection. ...
1
vote
1answer
176 views

Having problems with performing a JWT “none” algorithm attack

I'm taking a course where I must breach a site which uses 2015 version of JWT for authentication. They gave me the test//test login information and I must login with admin. After I log in, I receive ...
0
votes
1answer
426 views

Having a JWT that doesn't expire

I'm trying to understand why having a JWT access token that doesn't expire is bad for my application. The way I have written my backend, when the JWT comes in, I verify it and extract the subject ...
1
vote
0answers
29 views

The benefit of JWT refresh token if authorization and resource server are merged?

Is there any benefit in using refresh tokens if your auth and resource server are combined? I understand the benefit when they are separate: The refresh token is never sent to the resource server, ...
0
votes
2answers
160 views

Alternative to using Refresh Tokens?

I've been learning about OAuth2, JWT tokens, and refresh tokens. My understanding of this is: A user logs in using their credentials. They are given back an access token (short-lived) and a refresh ...

1
2 3 4 5 6