Questions tagged [jwt]

JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties.

Filter by
Sorted by
Tagged with
0
votes
2answers
107 views

Is this approach with JWT tokens wrong?

I have .NET Core WebApi application with JWT token for authorization. I also have roles and permissions. To make it more flexible for end user, I decided to make permissions like this: [Authorize(...
0
votes
1answer
56 views

How to handle authentication & authorization inside microservices

Example Application I will try to explain my problem by using a familiar application. Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
1
vote
1answer
61 views

HTTP(S) API authentication: why not many services require signing (HMAC)?

I am currently researching existing authentication/authorization solution that are used for REST APIs. More specifically I'm interested in backend-to-backend interactions but client-to-backend is ...
1
vote
0answers
35 views

Best Way To Store Password & JWT on Mobile

I have a Flutter and Angular application that previously used Firebase, but for various reasons I'm working on switching it over to my own RESTful API with ExpressJS. One topic I'm a little confused ...
2
votes
1answer
42 views

How to authorize and store user login from a xamarin frontend to a asp.net core api

So I suppose this question isn't as much as a 'How to' but a 'which way' kind of question. So I have a .net core api backend that makes calls to a dB I also have a xamarin forms project that ...
0
votes
0answers
12 views

Programmatic Application login into Jhipster Application

Let's say you have created a monolithic jhipster application with JWT authentication and where typically the login is by a user registering themselves and activating through email: Let's say that ...
2
votes
2answers
195 views

Where to save JWT token?

We(in my company) use to save the JWT token in the cookie. The web application is on Spring boot + JSP application. So the flow is, in a successful login service send a JWT token, that token has been ...
0
votes
2answers
55 views

Implement Sign Out for Specific Device in REST API

I'm currently developing a REST API which is supposed to be consumed by my App and desktop website. The user should not need to login every single time. Currently I implemented the following: First ...
0
votes
1answer
95 views

Microservice Architecture auth design

As a learning exercise I want to develop a system using microservices. I have designed my authentication/authorization architecture and would like to know if there are drawbacks to my design. It is ...
1
vote
1answer
19 views

Identity Server 4 Authentication - Security questions around using the same API for internal application and third parties

So, I have an API that authenticates with Identity Server OAuth2 and gives our user a JWT token when logging in through a front end application, this is a token that has access to everything. The API ...
2
votes
1answer
150 views

Why is it fine to use a user's ID in their JWT, as opposed to their email/username?

I'm wondering whether it is bad practice to keep a user's ID in a JWT. I'm planning on using the email in the sub, since it's already available to them, and I can use it to identify them, all the ...
2
votes
3answers
136 views

Securing API for third party use

We have a set of microservices and would like to expose endpoints from a subset of these for third parties to use. To this end, we will build an API Gateway that acts as the access control mechanism ...
0
votes
0answers
52 views

oauth2 + angular - Most elegant way to pass the JWT auth token

I have an angular application, which is querying an API as a client (written on Spring Boot 2.2.1 + Spring 5.2.1) that supports 3rd party authentication over OAuth2. The API has altogether 3 different ...
0
votes
0answers
50 views

Reverse proxy server with rotating JWT keys

I'm working on containerizing solution for a reverse proxy server that rotates a JWT token on a fixed interval. The server uses Nginx as a reverse proxy, and on a fixed period of time it re-...
2
votes
1answer
197 views

Which setup is more REST abiding?

I want to create an endpoint for "logging out". Logging out in my case is basically removing an access token from the database. Therefore DELETE verb makes sense here, something like this: DELETE URL/...
2
votes
2answers
818 views

Permission Based Access Control with JWT

I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT). Permission Requirement: ...
2
votes
0answers
59 views

Securing a microservice that will be accessible from frontend

I need an advice on securing interaction between an application App and a microservice RecordApp. App is the main application, where all users are registered and do some activity. RecordApp is a ...
4
votes
3answers
3k views

Is caching Access Tokens on the back end of a Web Application a good idea? (access_token storage best practices)

Let's suppose we have a Web Application that uses an Open Id Connect service provider, the Web Application uses the Authorization Code flow to get access to a different API, and therefore gets an ...
1
vote
2answers
373 views

Handling refresh token revocation

I've been implementing an authentication flow for an app that I've been making that uses JWTs. When a user is initially logged in or when they register (which immediately logs them in), I provide an ...
0
votes
0answers
64 views

Asynchronous Micro-Service Authorization

I have the following setup for my application: A User logs in and is granted a Session Token. When making API requests to Service A the User provides the Session Token. All requests go through an API ...
3
votes
1answer
677 views

REST API Authentication: Cookie vs Web Storage

Note: This question might sound like a duplicate, but all other similar questions did not take into account (mobile apps, iot's, web, 3rd party usage). Specifically, in dealing with the clients ...
4
votes
1answer
189 views

Client generated JWT

I'm working with a 3rd party company who are providing an API along with an unusual security approach. The security approach is essentially using a JWT by itself (no oauth). What's odd is that they'...
1
vote
2answers
2k views

Check if user is logged in when using JWT

I have an app that uses JWT tokens for user authorization. Now, I need to be capable of deactivating users (users won't be allowed to use the system but still exist in the database), but as a ...
0
votes
1answer
153 views

How to protect while loosely coupling a db server that is shared by 2 different services

Background information I have a database that will be used by two different web applications. Solution A (user driven web application) resides on the public internet and will write / update / delete ...
1
vote
2answers
699 views

When using Redux/Redux-Saga - should JWTs be set in the action creators/sagas?

Almost every blog post I've encountered around generic auth handling using JWTs in a React/Redux/Saga application does the same thing, which is to store the JWT in local storage, in the action/saga. ...
0
votes
1answer
69 views

How you can deal with making invalid a list of JWTs?

I design a new Rest API for a personal project and I am trying to implement the authentication and authorization mechanism as a separate project, so I ended up with a couple of problems which I am ...
1
vote
1answer
85 views

Using a JWT for a web service after logging in (login twice?)

Good day everybody, My capstone project partners are stumped with a logic question that has to do with JWT, MVC & web services. We have already built a web app with a signup/signin feature using ...
5
votes
2answers
9k views

Should we store JWTs in database?

While creating/assigning the JWTs to users, should we also store them in our databases? The negatives/cons of storing tokens in database would be, that all the data in the payload of the JWT token is ...
10
votes
2answers
5k views

Should access permissions and roles be included in payload of JWT?

Should information about the permissions and roles of the client be included in JWT? Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
1
vote
1answer
390 views

JWT with shared secret to share data between services of different vendors

We offer a platform that provides certain data processing services. All our APIs are accessible via RESTful services. All services require authentication and authorization to work properly (user/...
1
vote
0answers
131 views

Storing laravel API tokens from one API in another APIs env file

Last year my company started using Laravel to build APIs, and we created two separate repositories - one for a primary API and then a second for a secure API that would only accept requests from the ...
6
votes
2answers
566 views

How do you handle JWT expiration for long running calls?

Currently we are debating over securing our multiple micro-services. The major concern is that the JWT token provided to us will expire before the call is finished. (This is in the synchronous design) ...
0
votes
1answer
461 views

X.509 authentication for microservices with JavaEE [closed]

I am trying to design an app that is based on microservice architecture. Backend is written in JavaEE (micro profile, not Spring Boot), while for front-end I would use Angular5. Now I am wondering ...
0
votes
1answer
2k views

How Immadiately Blacklist and Block Access of Access Token using JWT?

I have read OAuth2 and its statelessness using JWT as token. Token expires based on expired time, then how do I control token like blacklist and block its access immediately without being stateful? ...
2
votes
1answer
313 views

How to use social sign in with my PHP website?

I have a website built on PHP, and now I want users to be able to log in. I do not want to take care of user management myself, so I'm thinking that social sign in would be convenient both for myself ...
1
vote
1answer
257 views

Creating JWT token internally

I need to implement JWT tokens in my ASP.NET Core API app to handle authorization. My question is, what is the risk of generating my own JWT token within my API app as opposed to having it handled ...
4
votes
2answers
161 views

Should ID be given in URL if already secured with JWT containing ID?

Say I have the endpoints: /users and /users/<id> If I wanted to DELETE a user authenticated with a JWT token that contains the user object, should this DELETE handled go under /users or /...
14
votes
1answer
826 views

Should microservices be users?

We are trying to determine the best way to authorise users in a microservice architecture, while ensuring microservices have limited permissions. Our architecture uses a central authorisation service ...
3
votes
2answers
875 views

What does “claim name collision” mean in the context of JWTs?

Recently, I have been reading the JWT' RFC and I'm struggling to understand the meaning of claim names collision. The registered claim names are more or less clear. If I got it right, these are ...
9
votes
3answers
6k views

Is it bad practice to store a user's email address in a JWT?

I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email address. To identify the subject of the JWT, I currently have a claim which stores the ...
13
votes
1answer
12k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
12
votes
2answers
12k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
1
vote
1answer
556 views

Handling tokens stored behind different microservices

I have a very interesting question that has proportionally blown up amongst my friends and I. This deals with handling user issued tokens from a series of authentication microservices. Remarks: ...
2
votes
1answer
1k views

How to handle JWT expiry in Laravel 5.3?

I am developing a mobile application back-end service using Laravel 5.3. I am following REST API. Application having payment gateway integration and it needs more security. I followed JWT auth by ...
33
votes
3answers
13k views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...