1

We have a Web server (which also does authentication and authorization) that manages, via an API, one or more servers that contain highly sensitive data. In the below architecture diagram, we manage everything except the end user: Architecture Diagram

We are looking at using JWTs for token based authentication/authorization. This token is issued from the Web server upon successful authentication. Following that, each request to the API servers would require that the user send their token through the Web server to the API servers.

The following diagram outlines the use case for a user wanting to access a protected resource on a given server: Use case

The reason the token is passed through the Web server is so that we can restrict connections from anything other than the Web server (via IP Address).

Ideally none of the servers, except the Web Server, need to know about all the users.

However, the greatest concern with this is that the Web Server is our single point of security. From my knowledge, if an attacker got full access to the Web Server, they'd be able to issue themselves a valid token and access the protected resources of the other servers.

I was thinking of having maybe an API Key (in conjunction with a username and password) that only the servers know about and not the Web Server. This could be added into the JWT when the token is created but never stored by the Web server. However, I'm not sure this is the best option.

Any help would be much appreciated...

Improve this question

1 Answer 1

Reset to default
1

Yes, if the attacker gains control over the auth server then they can generate their own tokens.

However there isn't much you can do about that. The auth server needs a private key in order to be able to sign the tokens.

What I would do is separate the auth server from the web server. Hide it behind a firewall and have the webserver call it. This will reduce the attack surface of the auth server

Improve this answer
2
  • Would using an API key in conjunction with the username and password increase security. This would mean if the Authentication server was hacked, the attacker would still need the API key to attach to the token in order to request protected resources to the server.
    – Matthew Knill
    Oct 28, 2020 at 21:51
  • possibly, although once you have the auth server you can be admin on the website, which presumably calls all the methods on the resources. so you have indirect access. If an attacker has got access to a box behind your firewall you are prob screwed whatever you do because they will all be on the same domain or cloud account or vm host or whatever
    – Ewan
    Oct 29, 2020 at 0:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.