Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Hot answers tagged

207

The Authorization: <type> <credentials> pattern was introduced by the W3C in HTTP 1.0, and has been reused in many places since. Many web servers support multiple methods of authorization. In those cases sending just the token isn't sufficient. Sites that use the Authorization : Bearer cn389ncoiwuencr format are most likely implementing ...


109

In Session-based Authentication the Server does all the heavy lifting server-side. Broadly speaking a client authenticates with its credentials and receives a session_id (which can be stored in a cookie) and attaches this to every subsequent outgoing request. So this could be considered a "token" as it is the equivalent of a set of credentials. There is ...


48

tl/dr: Your selected version of the JWT doesn't encrypt anything, it merely encodes it for easy transport. The data in the payload is not meant to be a secret. You have a JWS (JWT with signature). What you are looking at is simply the base64 encoded data payload. A JWS contains 3 parts: The base64 encoded header The base64 encoded data A cryptographic ...


47

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner. That may not have helped you at all. The reason I'm saying this is because you connected that laptop to the corporate network after you brought it back to your country. This loaner had MS Outlook and was linked to my ...


38

Long before bearer authorization, this header was used for Basic authentication. For interoperability, the use of these headers is governed by W3C norms, so even if you're reading and writing the header, you should follow them. Bearer distinguishes the type of Authorization you're using, so it's important.


27

There's a bit of confusion of terminology here. JWT defines the basic format of the claims, and some standard claims. It specifies that the JWT Claims Set should either be the payload of a JWS or a JWE structure. JWS defines a structure for some payload with a signature. While the payload is almost always JWT in practice, this is not a requirement of the ...


23

Industrial espionage is unfortunately very common in China. There are cases where spyware was installed on computing devices (allegedly by hotel staff) and in some cases even hardware spying devices were put into notebooks. Wiping every loaned notebook is a good way to get rid of any spyware. Some advisories suggest to weight any hardware before and after ...


21

Acceptably secure within the realm of what? You have described the basic flow for all bearer tokens. They who bear the token have the power. You do have a condition where you check if the token has been revoked, but that will mean the token is valid until they expire or are revoked. This is fundamentally the same as checking if the user is valid in the ...


20

Look at the authentication methods for unlocking phones. On my galaxy S4, there are: Swipe (no security) Face Unlock (low security) Face and Voice (low security) Pattern (medium security) PIN (medium to high) Password (high) From personal experience, the face unlock is kind of hard. You have to train it, and then you have to stick your face in the right ...


18

Quite simply, the token is not designed to be memorized so it can be as long as they want. A password is limited in length to what a person can practically reliably recall after a short memorization period. This limits it to 7-10 characters for most people. The token is designed to be copy/pasted, just once even (since it is application specific) ...


16

You cannot. It is unfortunate, but you cannot. Whatever is running as the client (barring some situations you are almost certainly not in involving TPM) can, if someone is sufficiently motivated, be completely understood. Someone can disassemble it, emulate it, patch it - there's virtually nothing you can do about this. What you need to do is not look at ...


14

You don't mention what sort of service it's for, but as a user the least irritating auth method on phones for me is SSO. I'm already signed into Google & Facebook anyway, so typically it's just a case of pressing "Yes" and we're all done.


14

What you're missing is that your token is signed (or, more precisely, authenticated with a symmetric key) but not encrypted. If you take the token in your question above, split it into three pieces at the periods (.) and feed each piece into a base64 decoder, you'll get the following decoded outputs: {"alg":"HS256","typ":"JWT"} {"sub":"1234567890","name":"...


12

1. Where to authenticate the user? If it is a user who needs to authenticate, then you need something in your front-end. From your front-end, you can just do a POST to your back-end, with the user credentials. You verify the user credentials, and issue an accesstoken/refreshtoken pair in case the credentials are known. You will ALWAYS have to go via the ...


12

There are several reasons for that. One reason is that memorable passwords are too short for the expected security level. Several methods are used to mitigate this problem, but it would be problematic to apply them to access tokens: Some services require a second authentication factor. Access tokens are meant to be used without user intervention, so most ...


11

I believe you are asking two questions: does changing payload invalidate signature: TL;DR: yes does adding encryption over JWT give you authenticity of content: TL;DR: don't encrypt yourself, use JWE! Here are the answers in more detail: (1) According to the specifications, https://www.rfc-editor.org/rfc/rfc7515.txt the signature of a signed JWT (JWS) ...


11

HashCash You could incorporate proof of work into the system: use something like HashCash to require the user to spend, say, 1 second of CPU-time to message your server. This system could be as simple as requiring the user to send a nonce with the message so that when the nonce and message are hashed together, it ends with 5 0's. There will be a tradeoff: ...


9

Your proposed mechanism is not secure. Anything available to JavaScript is available to the person running the client browser. Base64 encoding only mildly obscures the answers. Even encrypting them using strong crypto like AES will not work because the JavaScript must have the key. Would someone go the trouble of figuring out the Base64, or encryption? ...


9

Since you know that your plaintext tokens are unique (or at least this is a logical inference) you don't need a salt. The salt's intention is solely to provide hash-uniqueness in the case of identical passwords, but since your input space is intended to be guaranteed unique, you don't have this problem. Additionally, since you have control over the ...


8

Either way is fine, it just depends whether you want authentication to be stateless. Advantages of JWTs: Stateless. Little or no database overhead. Individual back-end components can validate the token in isolation, simply by knowing the secret key. Disadvantages: As authentication state is stored client-side, you cannot invalidate logins server-side. ...


8

Rate limiting, plain and simple. You need to determine just how important the service is. If it's a service that your application depends on, it needs to have security implemented. It could take the form of having the user login through their browser, then save a file to their home directory. Your app would then read the api key from the file and sign all ...


7

Yes its neccessary. A token can still be requested by a bruteforcer. Yes, it would cost the bruteforcer one request extra per try, but a captcha still blocks attempts completely instead. If you dont want to bother your users with a captcha, you could set so when a incorrect password is used, the account in question will require a captcha. This both thwarth ...


7

HTTP is stateless, and in order to have an authenticated state, you need some kind of token used to reference information about the user. This session id is usually in the form of a random token sent as a cookie value. An OAuth Access Token is used to identify a user, and the scope of resources that user has access to. In applications that use OAuth ...


7

A Bearer Token is set in the Authorization header of every Inline Action HTTP Request and Bearer itself determines the type of authentication. Ref https://developers.google.com/gmail/markup/actions/verifying-bearer-tokens


7

I'm assuming you are using some proprietary authentication solution, which is using JWT and refresh tokens but has nothing to do with OpenID Connect. JWT tokens are stateless, refresh tokens are usually statefull. You should look at advantages and disadvantages of statefull vs stateless tokens: Stateless tokens can be validated without extra DB/Service ...


6

If you have the user's mobile phone number (and if the user affirms during registration that this phone number can receive text messages), you can use this ability to enable 2-step authentication with SMS. Following successful authentication with a username and password, take one more step. Send the user a text message, by using the API to an SMS gateway ...


6

If it looks like base64 but isn't quite, it might be base64 with a custom alphabet. This is something that malware writers do to avoid detection (e.g., with data being exfiltrated) and that web application developers do when they think they're being clever (they're usually quite wrong, thinking it's harder to suss out than it is). I haven't tried to do so, ...


6

Using os.urandom() is perfectly alright. It generates a cryptographically secure random stream of bytes. This would be impossible to guess for anyone. Using guid() is also pretty secure, although not totally random. Using XOR to encode parameters into your token is a bad idea. For one, it is vulnerable to bit flipping attacks. Even if the user can not ...


6

The security lies in that you have a unique "access token" per client. So you can revoke and control as you will. Look at for example, Googles "App Passwords" which are the same thing. These tokens, of course make the 2FA no longer 2FA, but thats required for software and programs that do not support 2FA at all. The idea is that if a token becomes ...


5

A JWT token consists of a base64 encoded string containing header, claims and signature. The claims section contains a JSON encoded expiration field, exp: Expiration time. It contains the UTC Unix time after which you should no longer accept this token. It should be after the issued-at time. The username can also be stored in the claims object. There ...


Only top voted, non community-wiki answers of a minimum length are eligible