4 ms·
I use JWTs with RSA key pairs primarily. I tell the other service to make the pair and send me the public. I never see the private. Then I can verify all their
by genghisjahn 1y ago
I use JWTs with RSA key pairs primarily. I tell the other service to make the pair and send me the public. I never see the private. Then I can verify all their tokens with the public key.
This way I don’t have to worry about sharing the secret. It never leaves the other service.
- some_furry 1y ago> Then I can verify all their tokens with the private key. Mmmm. No. You're supposed to use a public key to verify the tokens, not a private key. What library are you using that tolerates this sort of misuse?
- firesteelrain 1y agoI think you meant verify with public key.
- genghisjahn 1y agoYes. I meant verify with public key. (Facepalm and updated)
- firesteelrain 1y agoIt’s easy to get mixed up.
- lyu07282 1y agoIsn't that what OIDC/JWKS is? That also uses PKI to verify JWT with public keys.