Questions tagged [jwt]

A JSON Web Token (JWT) is a signed token provided by a server to a client which can be used to validate certain claims, e.g. identity, that can be used for a third party, e.g. a service provider.

456 questions
101
votes
7 answers

Is refreshing an expired JWT token a good strategy?

If I understand best practices, JWT usually has an expiration date that is short-lived (~ 15 minutes). So if I don't want my user to log in every 15 minutes, I should refresh my token every 15 minutes. I need to maintain a valid session for 7 days…
Guillaume Vincent
  • 1,083
  • 2
  • 8
  • 9
46
votes
4 answers

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm using the HS512 algorithm to sign with a private key…
Aditya M P
  • 722
  • 1
  • 6
  • 11
41
votes
3 answers

How does JTI prevent a JWT from being replayed?

According to the JWT RFC a JWT can optionally have a JTI which I interpret to be a unique ID for a JWT. It seems like a UUID is a good value for a JTI. The RFC claims that the JTI can be used to prevent the JWT from being replayed. Two questions:…
ams
  • 623
  • 1
  • 5
  • 7
34
votes
1 answer

What are the differences between JSON Web Tokens, SAML and OAuth 2?

What are the differences between JSON Web Tokens, SAML and OAuth 2. Please provide some pointers and high level overview of their functions. Specifically, why would one use SAML over JSON Web Tokens or viceversa? Does one need to have OAuth 2 to use…
ASDF
  • 441
  • 1
  • 4
  • 3
34
votes
5 answers

Why are refresh tokens treated differently than access tokens

If we consider that having a valid refresh token allows you to get a valid access token, then the two can be considered to have the same 'informational value' right? Then why are they treated differently in terms of security aspects like expiration…
Javiliano
  • 459
  • 4
  • 6
32
votes
5 answers

What protects a JWT from being hijacked and used to pose as the original user?

Sorry for this possibly silly question, I'm just learning about JWT so please bear with me... I read the JWT docs extensively but I don't understand what prevents a hacker from hijacking the JWT and posing as the user for which it was originally…
longboardnode
  • 445
  • 1
  • 5
  • 8
31
votes
3 answers

Should I be able to see patterns in a HS256 encoded JWT?

I was fiddling with https://jwt.io/ using this header { "alg": "HS256", "typ": "JWT" } when I realized that replacing the payload name with something repetitive like AAAAAAAAAAAAAAAAAAAA would produce a token such as this:…
jmacedo
  • 429
  • 4
  • 6
27
votes
4 answers

What is the difference between JWT and encrypting some json manually with AES?

What is the difference between using a JSON Web Token (JWT) and simply having an AES key and sending and receiving encrypted JSON from the client? For example, this could be sent to the client: AES256.encrypt(JSON.stringify({id: 5552, admin: true}),…
FLUSHER
  • 403
  • 1
  • 4
  • 7
27
votes
2 answers

Is it safe to store a JWT in sessionStorage?

This article from Auth0 recommend storing the JWT locally in a local storage (or cookie). But this article from OWASP recommend not to story any sensitive data locally (not even sessionStorage) So, is it safe to store the JWT token locally or not?
Ghassan Karwchan
  • 389
  • 1
  • 3
  • 6
26
votes
5 answers

If JWT tokens are stateless how does the auth server know a token is revoked?

I've read that JWT tokens are stateless and you don't need to store the tokens in the database and that this prevents a look up step. What I don't understand is that according to RFC 7009 you can revoke a token. Let's say I have a web site with a…
Gilles
  • 665
  • 1
  • 6
  • 11
26
votes
5 answers

JWT: Why is audience important?

JWTs typically include an audience claim . I've read in many places (articles, code examples, the spec itself) that you must check that the token is intended for you and not another audience. I'm happy enough to accept that. I'm not planning on…
Andy N
  • 540
  • 1
  • 4
  • 13
26
votes
4 answers

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the transaction server. The two solutions being looked at are…
Nixman55
  • 393
  • 1
  • 3
  • 7
25
votes
3 answers

What is the impact of an exposed secret key for a JWT token implementation?

I am currently using JWT implementation for the authentication part of my APIs. A private key is used to sign the token generated and used to make sure it's not tampered with when it's used later for other API. My question is - What is the impact if…
darren19824
  • 361
  • 3
  • 5
25
votes
4 answers

Is a JWT usable as a CSRF token?

I'm in need of a CSRF token, for a certain application that submits a form with POST . Ideally, I'd like to not make a DB call for each submission, to avoid storage and DB traffic & latency. To this end OWASP's "CSRF Prevention Cheat Sheet" says,…
Thanatos
  • 1,106
  • 2
  • 11
  • 16
24
votes
2 answers

JWT: Choosing between HMAC and RSA

It is my understanding that HMAC is a symmetric signing algorithm (single secret key) whereas RSA is an asymmetric signing algorithm (private/public key pair). I am trying to choose between these 2 methods for signing JSON Web Tokens. However, I am…
4Matt
  • 465
  • 1
  • 3
  • 7
1
2 3
…
30 31