Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Use JSON Web Tokens

github.com

Post reply on HN
Print view View original

31–40 of 135 posts

Re: How to Use JSON Web Tokens

#31

Post by andrewstuart2 »

ForHackernews wrote: post #26
KaiserPro wrote: post #17

JWTs are useful, but there are a few things that are not immediately obvious. 1) They are signed not encrypted. Anything you put in there is public readable, unless you encrypt your token after you generate it 2) you can accept a range of encryption types, don't. Stick to one type and disallow any token that doesn't conform (this protects against people making their own tokens with 'None' as the signing algorithm) I…

You can have unsigned, signed, or encrypted JWTs. You're correct that many JWT libraries only do signed tokens by default, but there's a whole spec devoted to encryption: https://tools.ietf.org/html/rfc7516 (whether or not your library of choice implements it is a separate question)

This is one of the things I truly appreciate about JWT. They made it a) easy and b) possible to do signing, encryption, or both. If you've ever taken a shot at learning the specs behind SAML, the simplicity of JWT is hugely refreshing.

Re: How to Use JSON Web Tokens

#32

Post by manigandham »

KaiserPro wrote: post #17

JWTs are useful, but there are a few things that are not immediately obvious. 1) They are signed not encrypted. Anything you put in there is public readable, unless you encrypt your token after you generate it 2) you can accept a range of encryption types, don't. Stick to one type and disallow any token that doesn't conform (this protects against people making their own tokens with 'None' as the signing algorithm) I…

To be clear, cookies are an HTTP header field that can carry any text data you want. You can pass plain text, JWTs or any other encrypted payload (which many web frameworks do automatically).

JWTs aren't comparable to cookies, they're just a standard way to sign data.

Re: How to Use JSON Web Tokens

#33

Post by moduspwnens14 »

ros65536 wrote: post #30
KaiserPro wrote: post #17

JWTs are useful, but there are a few things that are not immediately obvious. 1) They are signed not encrypted. Anything you put in there is public readable, unless you encrypt your token after you generate it 2) you can accept a range of encryption types, don't. Stick to one type and disallow any token that doesn't conform (this protects against people making their own tokens with 'None' as the signing algorithm) I…

As mentioned in the article you might want the token to be read by the users. Such as issuing a token with a expiry date that you want the user to regenerate. Although If anything the JWT libraries should have encryption enabled by default.

It can also be helpful if:

- your system is distributed

- you don't want to be keeping a decryption key secure and in-sync across many (and potentially less-trusted) nodes

- the JWT contains attributes useful to the system (e.g. role, user ID, etc.)

You'll probably still be keeping track of a public key of whatever's signing it (to verify authenticity), but that isn't a secret. And then you can still securely trust

Re: How to Use JSON Web Tokens

#34

Post by jordache »

thosakwe wrote: post #23
jordache wrote: post #18

Earlier quoted context omitted.

> you could store a JWT in a cookie, if you wanted to. Huh? If it's an HTTPOnly cookie, how would you then insert the JWT token into the auth header?

If you’re using a cookie to store the JWT, you don’t really need to check the auth header.

if you're wrapping the JWT in a cookie, then it's effectively a session cookie. In that case, the client side difference between JWT and session cookies are effectively moot.

Re: How to Use JSON Web Tokens

#35

Post by orf »

sprt wrote: post #16
danesparza wrote: post #6

There are other ways to pass claims -- like using bearer tokens in the HTTP header, or using OAuth 2. (All with TLS, of course)

Yes, JWTs don't bring anything new to the table. In fact, most articles promoting their use don't even explain why you should use them. This is cargo cult programming at its utmost.

There are many ways to do many things. That doesn't make it cargo cult programming.

Encoding your claims as a JWT is useful because there are many libraries that work with this, it's a known format (and one that's not tied to any particular transport), and is really good for creating stateless authentication systems using asymmetric keys.

If you're interested in the differences between JWTs and something like OAuth (which really are two different things entirely) then you can visit https://google.com and type in "JWT vs Oauth2". Answers will appear on your screen.

Re: How to Use JSON Web Tokens

#37

Post by sjroot »

redbeard0x0a wrote: post #28
sjroot wrote: post #20

This page doesn’t have any discussion of strategies for expiring JWT, one of the biggest security issues with this auth mechanism. Even the code sample doesn’t include an expiration.

The JWT has a built-in field called exp, which is the time the token is expired. This is built in. However if you need to 'expire' a JWT token early, there isn't a good way to do it. If your token has a JTI, then you could add a blacklist for that JTI (say in redis, with a TTL until the token's exp time). But that is left to the implementor.

The page mentions the ‘exp’ field, but doesn’t use it in its example. I was suggesting the author point out the fact that, if someone gets a hold of a JWT without an expiration, then your system is in quite a bit of trouble.

Re: How to Use JSON Web Tokens

#38

Post by ynniv »

Dowwie wrote: post #2

JWTs are radioactive. Proceed with caution.

They're a complicated solution to a problem that you almost certainly don't have. Storing session data in a private datastore using a long random session identifier as the key is simpler, more secure, and more flexible than JWT.

Re: How to Use JSON Web Tokens

#39

Post by mattferderer »

KaiserPro wrote: post #17

JWTs are useful, but there are a few things that are not immediately obvious. 1) They are signed not encrypted. Anything you put in there is public readable, unless you encrypt your token after you generate it 2) you can accept a range of encryption types, don't. Stick to one type and disallow any token that doesn't conform (this protects against people making their own tokens with 'None' as the signing algorithm) I…

> 1) They are signed not encrypted. Anything you put in there is public readable, unless you encrypt your token after you generate it

Not a JWT expert but isn't this the point of a JWT or am I missing something. Sharing data between servers & clients while being able to make sure the data wasn't changed.

> 2) you can accept a range of encryption types, don't. Stick to one type and disallow any token that doesn't conform (this protects against people making their own tokens with 'None' as the signing algorithm)

People do this?? Why?

Re: How to Use JSON Web Tokens

#40

Post by jka »

KaiserPro wrote: post #17

JWTs are useful, but there are a few things that are not immediately obvious. 1) They are signed not encrypted. Anything you put in there is public readable, unless you encrypt your token after you generate it 2) you can accept a range of encryption types, don't. Stick to one type and disallow any token that doesn't conform (this protects against people making their own tokens with 'None' as the signing algorithm) I…

There are also a number of easy-to-make mistakes or gaps which can be introduced with the use of JWTs.

https://twitter.com/ejcx_/status/1063846166029197312 provides a great list of test cases covering the commonly reoccurring flaws.

The number and seriousness of these errors and how easy it is to make them does raise questions about how sensible it is to use JWT, unless you're really sure about what you're doing.

Post reply on HN