4 ms·
Forgive my ignorance (I know I'm missing something), but how do you distribute the shared secret to clients of a single page app? How do you keep the shared sec
by jsmeaton 12y ago
Forgive my ignorance (I know I'm missing something), but how do you distribute the shared secret to clients of a single page app? How do you keep the shared secret "secure"?
I've implemented something very similar to JWT (based on the old AWS auth scheme), but each client is given an API Key and their own Shared Secret. How does the server know whose shared secret it should use to validate messages?
- jsmeaton 12y agoI think I can answer my own question. The client doesn't get a shared secret. JWT is a server sending a token to the client which the client then sends back like a cookie. The client isn't allowed to modify the token or the data inside it. It's like a signed cookie.