4 ms·

How does this not lead to a situation where you are trusting the client for authentication/authorization information?

by emeraldd 12y ago

finnn 12y ago
It looks to me like the data is cryptographically signed
- akbar501 12y ago
  The JWT is signed. You can optionally encrypt the data in the token. However, the data in the main request is not encrypted, unless you're doing so via another means.
necubi 12y ago
Tokens can be either signed (using JWS [0]) or encrypted (JWE [1]), which means that you're just trusting that your encryption/signing key hasn't been leaked. [0] https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-31 https://tools.ietf.org/html/draft-ietf-jose-json-web-signatu... [1] http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption http://tools.ietf.org/html/draft-ietf-jose-json-web-encrypti...
akbar501 12y ago
The client must send authentication credentials to the server. For example, a username/password that's provided by a user. There's nothing initially stored on the client that allows it to authenticate without user input. Of course, you could use a holder of token scheme to authenticate in the case of server to server communication. However, in this case you're making an assumption that both servers can prevent access to the shared secret.
- jfroma 12y ago
  You got that right. In addition to what you described, the JWT spec also supports an RS family of algorithms (asymmetric). It means that you can sign with a private key and verify with a public key. For instance Google, sign every JWT with the same private secret and publish their key for verification [1]. If you use this, your server-side application not only needs to verify that the JWT signature is correct but also that the audience is your application. I wrote an example middleware for connect to verify Google's JWTs [2]. [1]: https://developers.google.com/accounts/docs/OAuth2Login#validatinganidtoken https://developers.google.com/accounts/docs/OAuth2Login#vali... [2]: https://www.npmjs.org/package/connect-google-jwt https://www.npmjs.org/package/connect-google-jwt

How does this not lead to a situation where you are trusting the client for authentication/authorization information?

finnn 12y ago

It looks to me like the data is cryptographically signed

akbar501 12y ago
The JWT is signed. You can optionally encrypt the data in the token. However, the data in the main request is not encrypted, unless you're doing so via another means.

necubi 12y ago

Tokens can be either signed (using JWS [0]) or encrypted (JWE [1]), which means that you're just trusting that your encryption/signing key hasn't been leaked. [0] https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-31 https://tools.ietf.org/html/draft-ietf-jose-json-web-signatu... [1] http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption http://tools.ietf.org/html/draft-ietf-jose-json-web-encrypti...

akbar501 12y ago

The client must send authentication credentials to the server. For example, a username/password that's provided by a user. There's nothing initially stored on the client that allows it to authenticate without user input. Of course, you could use a holder of token scheme to authenticate in the case of server to server communication. However, in this case you're making an assumption that both servers can prevent access to the shared secret.

jfroma 12y ago
You got that right. In addition to what you described, the JWT spec also supports an RS family of algorithms (asymmetric). It means that you can sign with a private key and verify with a public key. For instance Google, sign every JWT with the same private secret and publish their key for verification [1]. If you use this, your server-side application not only needs to verify that the JWT signature is correct but also that the audience is your application. I wrote an example middleware for connect to verify Google's JWTs [2]. [1]: https://developers.google.com/accounts/docs/OAuth2Login#validatinganidtoken https://developers.google.com/accounts/docs/OAuth2Login#vali... [2]: https://www.npmjs.org/package/connect-google-jwt https://www.npmjs.org/package/connect-google-jwt