Hot answers tagged

62 votes
Accepted

Is refreshing an expired JWT token a good strategy?

Refreshing a token is done to confirm with the authentication service that the holder of the token still has access rights. This is needed because validation of the token happens via cryptographic ...
Neil Smithline's user avatar
60 votes
Accepted

What is the impact of an exposed secret key for a JWT token implementation?

Whoever possesses the private key can create valid tokens where your system simply can not distinguish between a legitimate token and a token created by the attacker. I am guessing you are not just ...
phisch's user avatar
  • 1,305
49 votes

Should I be able to see patterns in a HS256 encoded JWT?

tl/dr: Your selected version of the JWT doesn't encrypt anything, it merely encodes it for easy transport. The data in the payload is not meant to be a secret. You have a JWS (JWT with signature). ...
Conor Mancone's user avatar
47 votes
Accepted

If JWT tokens are stateless how does the auth server know a token is revoked?

RFC 7009 is about OAuth, not JWT. You are mixing two different technologies: JWT and OAuth. This question on StackExchange summarizes it well. JWT is a token format. It defines the fields, the signing ...
ThoriumBR's user avatar
  • 53.9k
41 votes

What are the differences between JSON Web Tokens, SAML and OAuth 2?

SAML and OAuth 2 are protocols used in authentication/authorization. JSON Web Tokens (JWT) is a specification for a token that can be used in many applications or protocols - it happens that the ...
HTKLee's user avatar
  • 1,842
35 votes

What is the difference between JWT and encrypting some json manually with AES?

JSON Web Tokens (= JWTs) are based on the RFC 7519 and all differences will be extensively described there. If you take a look at this, you will see, that they are much more than what you seem to have ...
Tom K.'s user avatar
  • 7,975
30 votes
Accepted

Is it safe to store a JWT in sessionStorage?

How bizarre! I asked basically the same question about a month ago. In the end, we decided that using localstorage for the JWT token was ok, as long as we also did the following on the HTTP level: ...
JMK's user avatar
  • 2,496
30 votes
Accepted

Storing info in JWT payload

tl/dr: Although you could store the balance in your JWT and it would be safe from tampering, there are many ways in which the balance in the JWT might be technically valid but still incorrect. ...
Conor Mancone's user avatar
29 votes

Is a JWT usable as a CSRF token?

TL;DR A JWT, if used without Cookies, negates the need for a CSRF token - BUT! by storing JWT in session/localStorage, your expose your JWT and user's identity if your site has an XSS vulnerability (...
Scott Jungwirth's user avatar
27 votes
Accepted

What protects a JWT from being hijacked and used to pose as the original user?

JWT are only an encapsulation of information into a string with the ability to encrypt these information and detect tampering. JWT by themselves don't protect against cookie theft or misuse done with ...
Steffen Ullrich's user avatar
27 votes
Accepted

Should I be able to see patterns in a HS256 encoded JWT?

There's a bit of confusion of terminology here. JWT defines the basic format of the claims, and some standard claims. It specifies that the JWT Claims Set should either be the payload of a JWS or a ...
Bob's user avatar
  • 1,208
23 votes
Accepted

JWT: Choosing between HMAC and RSA

HMAC is used to prevent manipulation by someone who does not have access to the secret. Typically this means preventing manipulation by the client if the secret is only known to the server or to ...
Steffen Ullrich's user avatar
19 votes

Is refreshing an expired JWT token a good strategy?

You should refresh the token every 15 minutes, but you don't need to let the user authenticate again to do so. After authenticating, hand out a JWT that is valid for 15 minutes. Let the client ...
Sjoerd's user avatar
  • 30.4k
19 votes

How to handle refresh tokens

The point of having access tokens is that they can be used without checking for invalidation. You can have 10000 frontend servers users can access with the token without the need to ever ask some ...
Josef's user avatar
  • 5,973
19 votes

If JWT tokens are stateless how does the auth server know a token is revoked?

Do you need to store the refresh token in a database or store Leaving aside the rest of your question: generally, yes. JWTs need to be short-lived, specifically because there's no good way to revoke ...
CBHacking's user avatar
  • 47.6k
18 votes

Storing info in JWT payload

Yes you should query the database on each request. Using a JWT approach means you're relying on the client to send the correct JWT. If you're suggesting storing balance on the JWT then I presume ...
Andy N's user avatar
  • 502
17 votes

What is the most secure way to store cross subdomain cookies

From RFC 6265: 5.1.3. Domain Matching A string domain-matches a given domain string if at least one of the following conditions hold: o The domain string and the string are identical. (...
Ghedipunk's user avatar
  • 6,050
16 votes
Accepted

Access-control-allow-origin: * with a bearer token

There are a few things that will mean exploitation is unlikely. To start with access-control-allow-credentials: true access-control-allow-origin: * is an invalid combination: Important note: ...
SilverlightFox's user avatar
16 votes

Securely using JWTs with CSRF protection and refresh tokens

You seem to be mixing up several different opposing technologies, and do not make it clear why you have chosen these technologies and why they control the threats you are trying to secure against. ...
SilverlightFox's user avatar
16 votes
Accepted

Base64 encoding of a SHA256 hash

You are doing a conversion from hex encoding (or base16 if you like) to base64. So you are base64 encoding the ASCII characters 9 (57), B (66) and 2 (50) giving you OUIy. What you should be doing is ...
Anders's user avatar
  • 65.5k
16 votes
Accepted

How does a JWT refresh token improve security?

tl/dr: They key difference is that, unlike the JWT, the refresh token can be revoked. This allows it to have a longer liftetime and fill an important need in the JWT "ecosystem". Also, I ...
Conor Mancone's user avatar
15 votes
Accepted

Is a JWT usable as a CSRF token?

There is no need to encrypt the token or to include the nonce. The key properties of a CSRF token are that it is not predictable by an attacker, and, unlike cookies, that it is not added to every ...
Neil Smithline's user avatar
15 votes

Base64 encoding of a SHA256 hash

This should do; echo 9B2317C2C941A179130D0D28961AB542C88745658BE328F557422EA0AF8F60E8 | xxd -r -p | base64 Output: myMXwslBoXkTDQ0olhq1QsiHRWWL4yj1V0IuoK+PYOg=
Akash Mehta's user avatar
15 votes
Accepted

Stateless authentication with JWT: refresh token is not stateless

One of the main criticisms of stateless session tokens is the lack of a secure logout. Having a separate access/refresh token allows a compromise. You can greatly reduce the amount of database access, ...
paj28's user avatar
  • 33.4k
15 votes

Recommended asymmetric algorithms for JWT?

The short answer is to use RS256, to be understood as SHA 256 with RSA 2048 bits keys. See RFC 7518 JSON Web Algorithms (JWA) for all supported algorithms. On signing algorithms There are two major ...
user5994461's user avatar
  • 1,286
15 votes

JWT: Why is audience important?

Suppose I regularly use JWTs from AUTH SERVER to sign in to several several websites, including A and B. Without the aud claim, the JWTs would be identical. This would allow a malicious admin from A ...
Irfan434's user avatar
  • 759
14 votes
Accepted

RSA JWK format and parameters meaning

These are probably the parameters of an RSA key, as you can see here: https://www.gnupg.org/documentation/manuals/gcrypt-devel/RSA-key-parameters.html The naming convention matches with that one used ...
BBerastegui's user avatar
14 votes

Should I be able to see patterns in a HS256 encoded JWT?

What you're missing is that your token is signed (or, more precisely, authenticated with a symmetric key) but not encrypted. If you take the token in your question above, split it into three pieces ...
Ilmari Karonen's user avatar
13 votes
Accepted

Shared secret when using JWT with an HMAC for authentication

"Shared secret" in this case typically means between multiple servers, not between the client and the server. Typically, JWTs can be done using symmetric encryption - in which case all servers that ...
crovers's user avatar
  • 6,381
13 votes

What is the difference between JWT and encrypting some json manually with AES?

From my other sec.SE answer: JWT are self sufficient tokens which are used to share authentication information between different systems. They solve the problem of relying on third parties for ...
Shurmajee's user avatar
  • 7,447

Only top scored, non community-wiki answers of a minimum length are eligible