71–76 of 76 posts
I've implemented something very similar to JWT (based on the old AWS auth scheme), but each client is given an API Key and their own Shared Secret. How does the server know whose shared secret it should use to validate messages?
Forgive my ignorance (I know I'm missing something), but how do you distribute the shared secret to clients of a single page app? How do you keep the shared secret "secure"? I've implemented something very similar to JWT (based on the old AWS auth scheme), but each client is given an API Key and their own Shared Secret. How does the server know whose shared secret it should use to validate messages?
The client doesn't get a shared secret. JWT is a server sending a token to the client which the client then sends back like a cookie. The client isn't allowed to modify the token or the data inside it.
It's like a signed cookie.
JWTs are a pretty great solution for various authentication and authorization related problems, like OAuth tokens, password reset tokens and the like. Using an information-bearing (and signed) token like a JWT tends to make your web apps less stateful and simpler, by offloading the problems of determining authorizations to a single, central location. The main downside is that the representation (base64-encoded json)…
This seems like a case where Base-85 [1] would have been a better choice than Base64. [1] http://rfc.zeromq.org/spec:32
How secure are JSON Web Tokens? I understand the basics of JWT, but I'm not an encryption expert. - What is the most secure algorithm to use when creating the signature? - Should you do anything else on the server side besides verifying the signature? IE: tracking tokens, rotating keys, etc. Without knowing much about encryption it seems risky to simply trust a JWT based on signature alone. How hard would it be to ac…
The concepts of JWT encoding and encryption are orthogonal. While they can be used in conjunction with encryption, the question of whether or not the tokens themselves are "secure" is outside of the scope of their use. All standard encryption practices apply and there isn't anything special about using encryption with JWTs. Answering your questions completely depends upon your application. There is, in general, no "m…
I get the fact that security totally depends on implementation. I just need to better understand encryption and the differences between the various algorithms. If anyone knows of any good resources for learning about cryptography and encryption algorithms that would help a lot.
Is the advantage of using this instead of basic auth and HTTPS that you don't have to use basic auth and HTTPS? (Or if not basic auth, an authenticated session cookie over HTTPS.) I've seen many people write their own system to avoid implementing HTTPS. Which, as much as installing certs is expensive and complicated (especially keeping track of expiration) should probably be done for all web sites for other privacy a…
MAC schemes like JWT provide message integrity and a form of authentication that can't always be provided by TLS/HTTPS. The simplest way of describing it is that with HTTPS, when sending data to/from a server and a client (the client may even be another web server) you can be assured no one but the server or client can see or tamper with the data in transit. But the client is still able to trick the server, or vice v…