1

Good day everybody, My capstone project partners are stumped with a logic question that has to do with JWT, MVC & web services.

We have already built a web app with a signup/signin feature using a MVC framework, but for our capstone we need to securely access data from a web service (we have not builded yet). We considered about using jwt (JSON Web Tokens), but most of the examples we see require a login, one that interacts with the web service, which compares login info against service's data base.

With this theorem and flow, a user would need to login to our mvc app (that already has a data base all set up), then within the mvc app after logging in, send another login/register request to the web service (that has no connection to d.b) in order to establish a JWT.

To us this seems like much to work.

Is there a other way to communicate between a mvc app (uses a d.b to login already), with a service web? Could the service store user keys some way?

Thanks very much!! We are not native to English, please forgive our misspellings!

2

You are missing the point of JWT. Logging in is the process of confirming someone's identity (i.e. authentication). Once you've confirmed the identity, you generate the JWT with all the user's needed information (like roles, etc.). That JWT is then signed so that you know it is valid.

The browser needs to present the JWT as a bearer token, and the web service being called validates the token and retrieve's any user information needed from that token. (HTTP Header Authorization: Bearer {actual token content}).

The bottom line is that the user signs in one time, and the decisions of what the user can and cannot due is derived from information in that token (i.e. authorization).

It is an excellent means of minimizing network traffic in a microservice based application, and avoid sending username/password combinations all over the place.

And yes, there are libraries to make efficient use of JWTs with MVC apps.

4
  • Thank you for your perspective. If I am understanding correctly, it sounds like we should (or could) be storing something user related on the web service side (perhaps its own small SQLite d.b). This will allow us to verify user identity on the web service end. Please correct me if I am off! Thanks once again!
    – lucaEspos
    Aug 13 '18 at 2:59
  • 1
    no, the jwt contains the user info
    – Ewan
    Aug 13 '18 at 6:14
  • As @Ewan said, JWT contains all the user related information needed to do anything. The JWT sight has a pretty good whitepaper on how it all works: jwt.io Aug 13 '18 at 12:48
  • Thank you so much for your responses! We are going to implement it very soon.
    – lucaEspos
    Aug 14 '18 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.