Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [jwt]

JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties.

0
votes
0answers
33 views

What's the recommended way to deal with different authorization roles per microservice in an OAuth2 + JWT token scenario? Stateless vs stateful

Let's suppose an organization with a bunch of frontend applications (angular/react...). Each of them has an associated backend for frontend (BFF) microservice that provides a REST API: Front 1 ------...
0
votes
0answers
36 views

How to protect while loosely coupling a db server that is shared by 2 different services

Background information I have a database that will be used by two different web applications. Solution A (user driven web application) resides on the public internet and will write / update / delete ...
0
votes
2answers
76 views

When using Redux/Redux-Saga - should JWTs be set in the action creators/sagas?

Almost every blog post I've encountered around generic auth handling using JWTs in a React/Redux/Saga application does the same thing, which is to store the JWT in local storage, in the action/saga. ...
0
votes
1answer
54 views

How you can deal with making invalid a list of JWTs?

I design a new Rest API for a personal project and I am trying to implement the authentication and authorization mechanism as a separate project, so I ended up with a couple of problems which I am ...
0
votes
0answers
44 views

microservice authentication/ authorization: system token vs user token

I'm building a microservice architecture where basically each service represents a resource and each action on those resources are accessed control and secured by a UserToken (JWT) generated by a ...
1
vote
1answer
40 views

Using a JWT for a web service after logging in (login twice?)

Good day everybody, My capstone project partners are stumped with a logic question that has to do with JWT, MVC & web services. We have already built a web app with a signup/signin feature using ...
2
votes
2answers
1k views

Should we store JWTs in database?

While creating/assigning the JWTs to users, should we also store them in our databases? The negatives/cons of storing tokens in database would be, that all the data in the payload of the JWT token is ...
4
votes
1answer
1k views

Should access permissions and roles be included in payload of JWT?

Should information about the permissions and roles of the client be included in JWT? Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
0
votes
0answers
87 views

API Authentication with JWT by reference

We are in the process of rewriting our API and would like to have some advices. Requirements: Authentication will be done from various clients (mobile app, browser extension, single page app) ...
1
vote
1answer
94 views

JWT with shared secret to share data between services of different vendors

We offer a platform that provides certain data processing services. All our APIs are accessible via RESTful services. All services require authentication and authorization to work properly (user/...
1
vote
0answers
43 views

Storing laravel API tokens from one API in another APIs env file

Last year my company started using Laravel to build APIs, and we created two separate repositories - one for a primary API and then a second for a secure API that would only accept requests from the ...
0
votes
0answers
373 views

Scalable architecture for multi-tenant auth solution

We're evaluating two different architectures for setting up KeyCloak to allow users to grant access to other users and third parties to tenants within our system. I'm looking for experienced feedback ...
0
votes
0answers
1k views

Should I separate my authentication service and my user service?

I'm following a microservices architecture and using JWT for authorization and authentication. I have a User service that includes some details about users, and I was considering including ...
6
votes
2answers
310 views

How do you handle JWT expiration for long running calls?

Currently we are debating over securing our multiple micro-services. The major concern is that the JWT token provided to us will expire before the call is finished. (This is in the synchronous design) ...
0
votes
1answer
191 views

X.509 authentication for microservices with JavaEE [closed]

I am trying to design an app that is based on microservice architecture. Backend is written in JavaEE (micro profile, not Spring Boot), while for front-end I would use Angular5. Now I am wondering ...
0
votes
1answer
737 views

How Immadiately Blacklist and Block Access of Access Token using JWT?

I have read OAuth2 and its statelessness using JWT as token. Token expires based on expired time, then how do I control token like blacklist and block its access immediately without being stateful? ...
1
vote
1answer
192 views

How to use social sign in with my PHP website?

I have a website built on PHP, and now I want users to be able to log in. I do not want to take care of user management myself, so I'm thinking that social sign in would be convenient both for myself ...
1
vote
1answer
188 views

Creating JWT token internally

I need to implement JWT tokens in my ASP.NET Core API app to handle authorization. My question is, what is the risk of generating my own JWT token within my API app as opposed to having it handled ...
3
votes
2answers
101 views

Should ID be given in URL if already secured with JWT containing ID?

Say I have the endpoints: /users and /users/<id> If I wanted to DELETE a user authenticated with a JWT token that contains the user object, should this DELETE handled go under /users or /...
13
votes
1answer
586 views

Should microservices be users?

We are trying to determine the best way to authorise users in a microservice architecture, while ensuring microservices have limited permissions. Our architecture uses a central authorisation service ...
3
votes
1answer
522 views

What does “claim name collision” mean in the context of JWTs?

Recently, I have been reading the JWT' RFC and I'm having some difficulties to understand the meaning of collision regarding the claim names. The registered claim names are more or less clear. If I ...
3
votes
1answer
2k views

Is it bad practice to store a user's email in a JWT?

I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email. To identify the subject of the JWT, I currently have a claim which stores the user's ...
2
votes
1answer
4k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
8
votes
2answers
8k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
1
vote
1answer
333 views

Handling tokens stored behind different microservices

I have a very interesting question that has proportionally blown up amongst my friends and I. This deals with handling user issued tokens from a series of authentication microservices. Remarks: ...
2
votes
1answer
1k views

How to handle JWT expiry in Laravel 5.3?

I am developing a mobile application back-end service using Laravel 5.3. I am following REST API. Application having payment gateway integration and it needs more security. I followed JWT auth by ...
26
votes
3answers
8k views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...