Hot answers tagged

5

No, JWTs can never be either all lowercase or all uppercase. That's because they're a base64url encoding of a byte sequence that starts with {". All possible byte sequences starting with that, when encoded, will start with ey and then an uppercase letter from I to L. Case is relevant in the base64url encoding; aaaa encodes the octets 0x69 0xa6 0x9a, ...


3

The benefit of using some sort of public key for verification is that the verification can be done offline. For example, say I ask service XYZ to validate a user and, if authorized, provide a JWT. I can query service XYZ to provide me their long-term signing key once, and validate the JWTs that have been issued. As long as they continue to use the same ...


1

I'm convinced there is some confusion. Create a CA signed certificate using the GitHub App private key: openssl req -new -x509 -key <file-name>.key -out <certificate-name>.pem -days 1095 If I understand correctly, the previously generated private key is the key used to sign the certificate you're issuing (it functions as the signing CA). This ...


1

first question should I check that the user exists by calling the db ? Nope. Don’t check the user first. Two reasons. Denial of service. Ideally you never make a DB call until after you trust the request’s origin. If I’m a bad guy, and I can make your DB do work, it doesn’t matter how many elastic instances you spin up on AWS, you still have a small ...


1

There are a couple different types of POP (proof of possession) tokens, but let's take the kind that uses an asymmetric key pair. In this case, the authorization server and the client agree on an asymmetric key pair that represents the client (either side can generate this key pair) and the authorization server issues a token that represents the ...


1

This might not provide a full answer but I am unable to comment. The most common reason I can think of is the token containing data you might not want to leak to the user agent. This applies primarily to access tokens, which by design are only to be handled through the resource server. This could be either: Claims that might hint on how your API logic ...


Only top voted, non community-wiki answers of a minimum length are eligible