Skip to main content

Questions tagged [jwt]

JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties.

Filter by
Sorted by
Tagged with
0 votes
0 answers
52 views

Multi-tenant (realm based) REST Web API authentication

We're building a multi-tenant setup with a C# Web API and KeyCloak for auth and APISIX as application gateway. APISIX handles the authentication and passes an X-Access-Token to our API when ...
RobIII's user avatar
  • 341
0 votes
0 answers
43 views

Best design pattern for integrating Google OAuth with existing JWT token-based authentication system

We currently have a backend authentication mechanism in place that utilizes JWT tokens. Users sign in or sign up using email and password, and upon successful authentication, the backend issues JWT ...
Samiksha Garg's user avatar
1 vote
1 answer
102 views

Calling protected API from VueJS/Express via Access Token?

I'm trying to understand how Auth flows work within VueJS/Express Server to a protected API. I have a situation where I need to call an API that is protected by JWT. To get this JWT, a client ID and ...
Haden693's user avatar
0 votes
0 answers
58 views

Architecture Design using Queue and JWT Token for session management

I am planning to design a microservice system architecture for a ticketing platform. It will be similar to "TicketMaster". Here is the flow of my architecture: client web browser API ...
Isakkiii's user avatar
2 votes
1 answer
151 views

web-dev: how to restrict access to costly backend API to authenticated clients only

I've created a small prototype browser plugin and am now thinking about making it accessible to the public. This brings up an important question about gatekeeping API access and the right way to ...
lhk's user avatar
  • 446
0 votes
0 answers
117 views

JWT Cookie and API Gateway

Background I have an authentication microservice that handles the user authentication and returns 2 JWT cookies (access_token and refresh_token). I want to incorporate an API gateway that does the JWS ...
Neil's user avatar
  • 9
0 votes
0 answers
49 views

API authentication for iOS applications

I am currently working on my own iOS application and am going to be using a locally developed API for fetching data. I wanted to outline my current account sign-in architecture and verify this is ...
Trenton's user avatar
  • 17
0 votes
0 answers
117 views

How to handle Authorized & Non-Authorized Routes in Microservices with Tokens

Context Suppose there is a e-commerce microservice architecture with the format: In summary, a client will contact the Auth Service / Identity Service to receive a token. It passes the token to the ...
Gianluca Fuoco's user avatar
0 votes
1 answer
243 views

Bad Request or Unauthorized with missing data in POST / PUT

We have a simple POST / PUT that requires that some of the body data matches an organization id that is contained in the JWT. If the data doesn't match, that is clearly a 401 but wondering about an ...
andleer's user avatar
  • 169
0 votes
1 answer
578 views

Understanding the JWT and refresh token approach

I've read a few articles which cover the set up for refresh tokens and JWT tokens Is there a best practice in how/when to get the next JWT token. In my head, there are a few different approaches. I ...
MyDaftQuestions's user avatar
0 votes
3 answers
740 views

What are the advantages of refresh token?

A good auth system contains access and refresh tokens. I know what access-tokens are for and I know what refresh tokens DO - but I don't understand their meaning. For example: If I authenticate myself ...
Bamba675's user avatar
0 votes
2 answers
218 views

JWT token security - public key forgery prevention

Question on securing JWT token integrity, given the following scenario: Client sends a JWT to server signed with Client's private key Server caches public key, but uses http (and not https) to ...
arny's user avatar
  • 1
1 vote
1 answer
267 views

Mobile authentication approaches, JWTs and refresh tokens

Context I'm developing togther with my dev team a mobile app in a client-server architecture, since there will be a webclient too, allowing some users (admins) to perform certain operations from the ...
Leonardo Viada's user avatar
1 vote
2 answers
1k views

JWT logout: Sharing blacklisted invalid token among services

I am working on a microservices project involving 4 services - Auth Service, Service-A, Service-B and Service-C. All the services are implemented using Spring Boot. The Auth Service is responsible for ...
user14132461's user avatar
0 votes
1 answer
3k views

Blacklist JWT tokens or whitelist JWT tokens

I am working on a Spring Boot web application. The REST APIs are secured by JWT tokens. Currently I have only access token generated (not implemented refresh token concept). My question is related to ...
user14132461's user avatar
4 votes
1 answer
2k views

Authentication with JWT in HTTP only cookie without refresh token

The motto of the upcoming question is "I don't know what I don't know". I would like to know if there are downsides or security risks with an authentication implementation. Right now, I'm ...
Bennett Dams's user avatar
0 votes
1 answer
370 views

Enriching JWT after OpenID Connect flow

I am struggling to find a good solution for authorization of users after they were properly authenticated through an oidc flow. Let's assume the following setup: An angular SPA is interacting with ...
Marc Wittke's user avatar
0 votes
0 answers
200 views

Using JWT token to create spring session

I have a web application like this: An angular frontend for client and a spring MVC backend for admin panel. A angular web application requests a JWT token from tomcat/spring MVC. The angular ...
desertSniper87's user avatar
2 votes
1 answer
1k views

Storing permanent JWT in HttpOnly + SameSite=Strict + Secure cookie?

I'm wondering what are the nowadays risks of storing a JWT that does not expire in an HttpOnly, SameSite=Strict, and Secure cookie. I understand localStorage is vulnerable to XSS, and that normal ...
lewislbr's user avatar
  • 129
2 votes
1 answer
1k views

Refresh tokens by example using Angular and Spring Boot

I am designing out an app that would have an Angular frontend and Spring Boot (Java) backend. I was considering (but not married to) the prospect of JWT-based authentication: User logs in with ...
hotmeatballsoup's user avatar
1 vote
2 answers
108 views

Should I check for non-existing users with correctly signed tokens?

I ran into an issue when developing where a user that did not exist, but had a correctly signed JWT, was logged in. This happened when I absentmindedly logged in using a browser while running the test ...
August Janse's user avatar
2 votes
1 answer
303 views

Is it good practice to use the sub claim as the user_id in my app

The resources on the web I have seen so far suggest that the 'sub' claim in a JWT identifies the principal. According to this question, at least for some identity provider implementations, one cannot ...
coderobot's user avatar
14 votes
3 answers
15k views

API key vs JWT - which authentication to use and when

I have read multiple pages/blog posts on API key vs JWT and still I'm confused when to use one of them. Most recent one are saying that JWT became a standard for API authentication but then it became ...
JackTheKnife's user avatar
4 votes
2 answers
4k views

Should I return user data in an authentication endpoint using JWT?

I implement an auth endpoint which takes an email and password and returns a JWT token. Inside the JWT there is a payload containing the user ID. Does it matter from a REST/JWT standards perspective ...
auerbachb's user avatar
  • 181
2 votes
1 answer
379 views

What identity and/or access data are JWT claims intended for?

I am an application developer and am building a token-based auth mechanism for my application. Essentially, the user will log in with username+password, if the credentials are valid, my code will ...
hotmeatballsoup's user avatar
0 votes
1 answer
176 views

OWASP Broken Access Control by example: preventing user's from reading/writing data that isn't theirs

I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them. A situation was just presented to me that ...
hotmeatballsoup's user avatar
1 vote
1 answer
2k views

Token based authentication to multiple API servers

We have a Web server (which also does authentication and authorization) that manages, via an API, one or more servers that contain highly sensitive data. In the below architecture diagram, we manage ...
Matthew Knill's user avatar
0 votes
0 answers
77 views

Where to carry JWT Tokens in Requests

I have an AspNet application which I'm authenticating using a separate AspNet Core application. It returns a JWT token which is then carried in a Http Cookie. The AspNet application validates each ...
user3167162's user avatar
1 vote
1 answer
1k views

Securing API with JWT and elevated access using MFA

At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
abdusco's user avatar
  • 119
1 vote
0 answers
46 views

Building an app+backend with extraneous functionality for an existing web shop. How to handle authentication on the backend?

This is an architecture question as I've been asked by an existing web store to build a mobile app (they don't have a mobile app) that provides extra functionality to the store, a web admin panel to ...
BobRoy's user avatar
  • 19
5 votes
3 answers
2k views

When to derive user ID from authentication token vs. validate against?

I am using JSON web tokens, but this authentication token can be any token from which a unique user can be derived. I am designing a REST API that allows CRUD operations on resources owned by specific ...
Mario Ishac's user avatar
2 votes
3 answers
711 views

Is this approach with JWT tokens wrong?

I have .NET Core WebApi application with JWT token for authorization. I also have roles and permissions. To make it more flexible for end user, I decided to make permissions like this: [Authorize(...
Jamil's user avatar
  • 131
1 vote
1 answer
628 views

How to handle authentication & authorization inside microservices

Example Application I will try to explain my problem by using a familiar application. Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
Michiel's user avatar
  • 173
1 vote
1 answer
515 views

HTTP(S) API authentication: why not many services require signing (HMAC)?

I am currently researching existing authentication/authorization solution that are used for REST APIs. More specifically I'm interested in backend-to-backend interactions but client-to-backend is ...
Max Komarychev's user avatar
1 vote
0 answers
167 views

Best Way To Store Password & JWT on Mobile

I have a Flutter and Angular application that previously used Firebase, but for various reasons I'm working on switching it over to my own RESTful API with ExpressJS. One topic I'm a little confused ...
Gabe's user avatar
  • 127
4 votes
1 answer
1k views

How to authorize and store user login from a xamarin frontend to a asp.net core api

So I suppose this question isn't as much as a 'How to' but a 'which way' kind of question. So I have a .net core api backend that makes calls to a dB I also have a xamarin forms project that ...
dros's user avatar
  • 167
3 votes
2 answers
2k views

Where to save JWT token?

We(in my company) use to save the JWT token in the cookie. The web application is on Spring boot + JSP application. So the flow is, in a successful login service send a JWT token, that token has been ...
Muztaba Hasanat's user avatar
-1 votes
2 answers
210 views

Implement Sign Out for Specific Device in REST API

I'm currently developing a REST API which is supposed to be consumed by my App and desktop website. The user should not need to login every single time. Currently I implemented the following: First ...
petul's user avatar
  • 99
-1 votes
1 answer
152 views

Microservice Architecture auth design

As a learning exercise I want to develop a system using microservices. I have designed my authentication/authorization architecture and would like to know if there are drawbacks to my design. It is ...
Heisenberg's user avatar
1 vote
1 answer
71 views

Identity Server 4 Authentication - Security questions around using the same API for internal application and third parties

So, I have an API that authenticates with Identity Server OAuth2 and gives our user a JWT token when logging in through a front end application, this is a token that has access to everything. The API ...
Alexander Johansen's user avatar
4 votes
1 answer
5k views

Why is it fine to use a user's ID in their JWT, as opposed to their email/username?

I'm wondering whether it is bad practice to keep a user's ID in a JWT. I'm planning on using the email in the sub, since it's already available to them, and I can use it to identify them, all the ...
yaserso's user avatar
  • 199
2 votes
3 answers
1k views

Securing API for third party use

We have a set of microservices and would like to expose endpoints from a subset of these for third parties to use. To this end, we will build an API Gateway that acts as the access control mechanism ...
Umair's user avatar
  • 185
0 votes
0 answers
170 views

oauth2 + angular - Most elegant way to pass the JWT auth token

I have an angular application, which is querying an API as a client (written on Spring Boot 2.2.1 + Spring 5.2.1) that supports 3rd party authentication over OAuth2. The API has altogether 3 different ...
Romeo Sierra's user avatar
2 votes
2 answers
434 views

REST endpoint name for "logging out" with a token

I want to create an endpoint for "logging out". Logging out in my case is basically removing an access token from the database. Therefore DELETE verb makes sense here, something like this: DELETE URL/...
Omar Hossam Ahmed's user avatar
2 votes
2 answers
3k views

How to efficiently pass permissions that control view and access of specific front-end elements from backend to the SPA using JWT

I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT). Permission Requirement: ...
panda's user avatar
  • 171
2 votes
1 answer
162 views

Securing a microservice that will be accessible from frontend

I need an advice on securing interaction between an application App and a microservice RecordApp. App is the main application, where all users are registered and do some activity. RecordApp is a ...
Defake's user avatar
  • 121
8 votes
3 answers
10k views

Is caching Access Tokens on the back end of a Web Application a good idea? (access_token storage best practices)

Let's suppose we have a Web Application that uses an Open Id Connect service provider, the Web Application uses the Authorization Code flow to get access to a different API, and therefore gets an ...
Hamza's user avatar
  • 99
1 vote
2 answers
767 views

Handling refresh token revocation

I've been implementing an authentication flow for an app that I've been making that uses JWTs. When a user is initially logged in or when they register (which immediately logs them in), I provide an ...
Samuel Innocent-Primus Mungy's user avatar
1 vote
0 answers
189 views

Asynchronous Micro-Service Authorization

I have the following setup for my application: A User logs in and is granted a Session Token. When making API requests to Service A the User provides the Session Token. All requests go through an API ...
Rohan Shah's user avatar
3 votes
1 answer
2k views

REST API Authentication: Cookie vs Web Storage

Note: This question might sound like a duplicate, but all other similar questions did not take into account (mobile apps, iot's, web, 3rd party usage). Specifically, in dealing with the clients ...
curiousyigit's user avatar