2

I am using JWT for authentication in a micro service architecture. There is 1 UI web app and multiple REST API exposed services in the backend. I am considering a IAM service which will give a JWT to UI with permission information. The UI can use this to contact another Micro service X. But in this case should X contact IAM to validate or since it is self contained, should X go ahead with the request ?

Note that users can logout their sessions in IAM.

Improve this question

1 Answer 1

Reset to default
4

X should check the signature and expiry on the JWT auth token and not contact the auth server directly

Logout adds a wrinkle to the problem as the user may have logged out before the expiry date on the token.

But the auth token should have a short (1/2 min) expiry. Limiting the problem of a hacker using an intercepted token.

The refresh token should have a longer expiry but ONLY be sent to the auth server to generate new auth tokens

Improve this answer
9
  • That sounds like a plan. But this also means that every time I need to send a request to X, I need to send a request to IAM to get the access token. Also our security team might not accept that short interval possibility as well.
    – TechCrunch
    Commented Apr 7, 2017 at 4:32
  • Also, in the current design, we have to expire the user session on 30 minutes of inactivity. So we are using a id_token for all purposes and not using refresh / access token concept. We are refreshing the id_token at 1/2 of 30 minutes as long as there is user activity in the browser such as mouse move, key board click.
    – TechCrunch
    Commented Apr 7, 2017 at 4:34
  • my recommendation is to follow the refresh/auth oauth2 pattern. Its all specced out and reviewed for security. Plus there are libraries for various languages. True, if you have infrequent requests you will have to use the refresh token before each. but the purpose​ of the JWT token is precisely to AVOID the resource having to connect to the auth server
    – Ewan
    Commented Apr 7, 2017 at 5:10
  • If I want to go with that pattern, I should use my refresh token to expire in 30 minutes and keep getting a new refresh token on user activity? Isn't it that we should authenticate the user before getting refresh token ?
    – TechCrunch
    Commented Apr 7, 2017 at 5:15
  • 1
    you have the refresh token expire in days. you must send the username and pass to get a refresh token. so initial login -> refresh token + auth token -> make request with auth token untill expirey -> send refresh token to the auth server to get a new auth token -> logout -> invalidate refresh token
    – Ewan
    Commented Apr 7, 2017 at 5:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.