3 ms·

How secure are JSON Web Tokens? I understand the basics of JWT, but I'm not an encryption expert. - What is the most secure algorithm to use when creating the

How secure are JSON Web Tokens? I understand the basics of JWT, but I'm not an encryption expert. - What is the most secure algorithm to use when creating the signature? - Should you do anything else on the server side besides verifying the signature? IE: tracking tokens, rotating keys, etc. Without knowing much about encryption it seems risky to simply trust a JWT based on signature alone. How hard would it be to actually spoof a JWT with the most secure encryption algorithm?

charlieok 12y ago
That's probably best addressed by the “security considerations” section of the JWT spec: https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-25#section-11 https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-... My short answer to “How secure are JSON Web Tokens?”, though, would be that the relevant security issues are likely to come in “around” the use of JWTs, not as a result of JWTs themselves being “weak”. JWT is just a set of conventions for encoding authn/authz claims in JSON and then encrypting/signing the result.
johnhenry 12y ago
The concepts of JWT encoding and encryption are orthogonal. While they can be used in conjunction with encryption, the question of whether or not the tokens themselves are "secure" is outside of the scope of their use. All standard encryption practices apply and there isn't anything special about using encryption with JWTs. Answering your questions completely depends upon your application. There is, in general, no "most secure" algorithm for encryption and what you handle on the server completely depends upon the security goals of your application. For example, I'm currently working on something that passes JWTs unencrypted and unsigned because the application simply doesn't need it. Furthermore, the application does have a method of tracing used tokens, but there isn't really a need for rotating keys or anything else like that. Hope that helps.
- chriserwin 12y ago
  Thanks that does help. I get the fact that security totally depends on implementation. I just need to better understand encryption and the differences between the various algorithms. If anyone knows of any good resources for learning about cryptography and encryption algorithms that would help a lot.

charlieok 12y ago

That's probably best addressed by the “security considerations” section of the JWT spec: https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-25#section-11 https://tools.ietf.org/html/draft-ietf-oauth-json-web-token-... My short answer to “How secure are JSON Web Tokens?”, though, would be that the relevant security issues are likely to come in “around” the use of JWTs, not as a result of JWTs themselves being “weak”. JWT is just a set of conventions for encoding authn/authz claims in JSON and then encrypting/signing the result.

johnhenry 12y ago

The concepts of JWT encoding and encryption are orthogonal. While they can be used in conjunction with encryption, the question of whether or not the tokens themselves are "secure" is outside of the scope of their use. All standard encryption practices apply and there isn't anything special about using encryption with JWTs. Answering your questions completely depends upon your application. There is, in general, no "most secure" algorithm for encryption and what you handle on the server completely depends upon the security goals of your application. For example, I'm currently working on something that passes JWTs unencrypted and unsigned because the application simply doesn't need it. Furthermore, the application does have a method of tracing used tokens, but there isn't really a need for rotating keys or anything else like that. Hope that helps.

chriserwin 12y ago
Thanks that does help. I get the fact that security totally depends on implementation. I just need to better understand encryption and the differences between the various algorithms. If anyone knows of any good resources for learning about cryptography and encryption algorithms that would help a lot.