4 ms·

Jwt are usually signed with a private key, and the corresponding public key you need for verification is static/fetchable for dog-and-world. Not sure why he wa

• anderspitman 7y ago
  Oh that makes sense. Idk, I think that's actually a good deal simpler than oauth. With a single request you get a token that says emauth.io verifies that at X time the owner of this token had control over Y email address. Anyone can then use emauth.io's public key to verify the claim. This makes the "email whitelist" use case trivial to implement on the server. You just have to have expiration logic.
  • y4mi 7y ago
    I don't see how. There are libraries to interface with these oauth solutions so you basically just send them to the corresponding server and wait for them to come back with their token , which you'll verify with said library... You're done
    • anderspitman 7y ago
      Do you have an example of such a library/service?
      • y4mi 7y ago
        I should probably point out that I'm talking about an authentication framework which includes sessions etc. I just can't see any other way for jwts granted by your service to be useful. If it sounded like your service already exists as an open source solution with libraries for every language... I don't believe it does, it at least I don't know about it. You could actually implement it with a module in keycloak, but you'd need to write the code yourself. Though it shouldn't be too hard https://www.keycloak.org/ https://www.keycloak.org/ https://www.keycloak.org/downloads.html https://www.keycloak.org/downloads.html There are community libraries for other languages as well. And lots of code example for custom authentication flows like https://github.com/stianst/keycloak-experimental/tree/master/magic-link https://github.com/stianst/keycloak-experimental/tree/master... And an example implementing the auth flow with libraries for a webservice https://github.com/houmie/sso/blob/master/src/app.py https://github.com/houmie/sso/blob/master/src/app.py (I'm unrelated to all links, just got them from quick Google searches)
        • anderspitman 7y ago
          A way it would be useful without sessions is if you have a webapp that loads a list of email addresses on startup. For each request that comes in, it checks if the request has an emauth JWT (maybe passed in a Emauth-Token header). If it does, it verifies the sig, then checks the contained email address against the whitelist. If it matches the request goes through.
          • y4mi 7y ago
            Yeah, but how would you log a user out? Delete the local token? And if someone got access to the token, your account will be owned forever with no way to revoke the access. Unless you auto expire them... Now you need a flow to refresh the tokens.... If you implement jwt, you will need sessions and all other features authentication servers have... It would be way easier to implement a custom authentication flows mimicking your email auth than recreating everything else. I think your service is good as is and introducing jwt to it would be a net-negative But I'm just a random person from the internet, do whatever you feel like doing ;)
            • anderspitman 7y ago
              Sorry, I didn't notice you had responded. I think maybe you're reading too much into adding JWTs to emauth.io. It simply provides another source of information, ie that as of a certain time, emauth.io verifies that the holder of this token had control over the email address. Implementations can do whatever they want with that information, depending on their threat model. And since previously the API was returning a fairly redundant text response (status code already tells you whether verification was successful), returning the JWT doesn't interfere with the previous functionality.
      • PhilippGille 7y ago
        Keycloak and CAS for example are popular in the Java ecosystem. But generally any authentication server that can generate JWTs for authenticated users. And then with any JWT lib you check the validity (expiration, signature, ...) of the token. See https://jwt.io https://jwt.io for a list of libs.
• deleted 7y ago
  [deleted]