3 ms·
I would highly recommend building in key rotation and a well-known endpoint for retrieving public keys. In the Node.js documentation (https://userfront.com/exam
by primitivesuave 5y ago
I would highly recommend building in key rotation and a well-known endpoint for retrieving public keys. In the Node.js documentation (https://userfront.com/examples/nodejs.html https://userfront.com/examples/nodejs.html), the expectation seems to be that a single public key is hard-coded into all customer applications. If UserFront's private key is compromised for whatever reason, it should be trivial to rotate keys without requiring all customers to update their application with the new public key.
- jon-wood 5y agoThis is a tough one to balance. Ideally you want applications to be able to pull new public keys if the private keys are rotated, but equally you’ve now just introduced a path via which an attacker with control of the domain that we’ll known endpoint is hosted on with a path to replace your keys.
- AllModules 5y ago> it should be trivial to rotate keys This is exactly what we're rolling out in the next few weeks. We already have it trivial to rotate API keys [1], and we have a JWKS endpoint [2], so rotating the primary JWT private key is next on the list. [1] https://userfront.com/docs/api.html#api-keys https://userfront.com/docs/api.html#api-keys [2] https://userfront.com/docs/api.html#json-web-key-set-jwks https://userfront.com/docs/api.html#json-web-key-set-jwks