2 ms·
The client must send authentication credentials to the server. For example, a username/password that's provided by a user. There's nothing initially stored on t
by akbar501 12y ago
The client must send authentication credentials to the server. For example, a username/password that's provided by a user. There's nothing initially stored on the client that allows it to authenticate without user input.
Of course, you could use a holder of token scheme to authenticate in the case of server to server communication. However, in this case you're making an assumption that both servers can prevent access to the shared secret.
- jfroma 12y agoYou got that right. In addition to what you described, the JWT spec also supports an RS family of algorithms (asymmetric). It means that you can sign with a private key and verify with a public key. For instance Google, sign every JWT with the same private secret and publish their key for verification [1]. If you use this, your server-side application not only needs to verify that the JWT signature is correct but also that the audience is your application. I wrote an example middleware for connect to verify Google's JWTs [2]. [1]: https://developers.google.com/accounts/docs/OAuth2Login#validatinganidtoken https://developers.google.com/accounts/docs/OAuth2Login#vali... [2]: https://www.npmjs.org/package/connect-google-jwt https://www.npmjs.org/package/connect-google-jwt