jwt.pdf

Myself
2006 ‑ 2014: Researcher at TU/e
2014 ‑ 2016: iOS and Java developer at ISAAC
2016 ‑ present: (Mostly) Java developer at Kabisa

Kabisa
Web apps ‑ Hybrid mobile apps
Ruby on Rails ‑ Java ‑ Elixir
Backbone ‑ Marionette ‑ React
Agile ‑ TDD ‑ BDD
Weert ‑ Amsterdam

nginx
Your device
Postgres
Spring
Spring
Spring

Client
Client
Server
Server
username and password
start session
sessionToken
request with sessionToken
response
response
error

eyJhbGciOiJIUzUxMiJ9.eyJleHAiOjE0NzYyOTAxNDksInN1YiI6IjEi
fQ.mvJEWu3kxm0WSUKu‑qEVTBmuelM‑2Te‑
VJHEFclVt_uR89ya0hNawkrgftQbAd‑
28lycLX2jXCgOGrA3XRg9Jg

{
"
a
l
g
"
: "
H
S
5
1
2
"
}
{
"
s
u
b
"
: "
1
"
,
"
a
d
m
i
n
"
: f
a
l
s
e
}
H
M
A
C
S
H
A
2
5
6
(
b
a
s
e
6
4
U
r
l
E
n
c
o
d
e
(
h
e
a
d
e
r
) + "
.
" +
b
a
s
e
6
4
U
r
l
E
n
c
o
d
e
(
p
a
y
l
o
a
d
)
,
s
e
c
r
e
t
)

Client
Client
Server
Server
username and password
construct JWT
JWT
request with JWT
check JWT
response
request with JWT
check JWT
response

Where to leave these tokens?
In a cookie?
In a header?

Intermezzo: XSS and CSRF
XSS
Someone is able to have their scripts executed as part of your web
application.
<
% S
t
r
i
n
g e
i
d = r
e
q
u
e
s
t
.
g
e
t
P
a
r
a
m
e
t
e
r
(
"
e
i
d
"
)
; %
>
.
.
.
E
m
p
l
o
y
e
e I
D
: <
%
= e
i
d %
>

CSRF
Someone else's web application secretly lets its visitors perform
actions with your web application due to cookies still present from
previous visits.
<
f
o
r
m a
c
t
i
o
n
=
"
h
t
t
p
:
/
/
b
a
n
k
.
c
o
m
/
t
r
a
n
s
f
e
r
.
d
o
" m
e
t
h
o
d
=
"
P
O
S
T
"
>
<
i
n
p
u
t t
y
p
e
=
"
h
i
d
d
e
n
" n
a
m
e
=
"
a
c
c
t
" v
a
l
u
e
=
"
M
A
R
I
A
"
/
>
<
i
n
p
u
t t
y
p
e
=
"
h
i
d
d
e
n
" n
a
m
e
=
"
a
m
o
u
n
t
" v
a
l
u
e
=
"
1
0
0
0
0
0
"
/
>
<
i
n
p
u
t t
y
p
e
=
"
s
u
b
m
i
t
" v
a
l
u
e
=
"
V
i
e
w m
y p
i
c
t
u
r
e
s
"
/
>
<
/
f
o
r
m
>

p
r
i
n
t "
<
h
t
m
l
>
"
p
r
i
n
t "
L
a
t
e
s
t c
o
m
m
e
n
t
:
"
p
r
i
n
t d
a
t
a
b
a
s
e
.
l
a
t
e
s
t
C
o
m
m
e
n
t
p
r
i
n
t "
<
/
h
t
m
l
>
"

<
i
m
g s
r
c
=
"
h
t
t
p
:
/
/
l
o
c
a
l
h
o
s
t
:
8
0
8
0
/
g
u
i
/
?
a
c
t
i
o
n
=
a
d
d
-
u
r
l
&
s
=
h
t
t
p
:
/
/
e
v
i
l
.
e
x
a
m
p
l
e
.
c
o
m
/
b
a
c
k
d
o
o
r
.
t
o
r
r
e
n
t
"
>

Defence against CSRF is straightforward
and durable
1. Check the origin and referer headers
2. Check for some other header you're setting, such as X‑
Requested‑With
See www.owasp.org

What happens when I change my
password?
{
"
a
l
g
"
: "
H
S
5
1
2
"
}
{
"
s
u
b
"
: "
1
"
,
"
a
d
m
i
n
"
: f
a
l
s
e
}
H
M
A
C
S
H
A
2
5
6
(
b
a
s
e
6
4
U
r
l
E
n
c
o
d
e
(
h
e
a
d
e
r
) + "
.
" +
b
a
s
e
6
4
U
r
l
E
n
c
o
d
e
(
p
a
y
l
o
a
d
)
,
s
e
c
r
e
t
)

When should a JWT expire?
As soon as possible, to prevent misuse for long periods
As late as possible, so that users don't have te re‑authenticate
all the time

When should a JWT expire?
Introduce a short‑lived token used for authentication per request
Introduce a long‑lived token used to generate a new short‑lived
token when needed
The long‑lived token is used in combination with a blacklist of
retracted tokens

Should I accept all "valid" JWTs?
No, because "none" is a valid algorithm
The key you use to check the signature should match the
algorithm
See https://auth0.com/blog/critical‑vulnerabilities‑in‑json‑web‑
token‑libraries/

What happens when I delete my
account?
{
"
a
l
g
"
: "
H
S
5
1
2
"
}
{
"
s
u
b
"
: "
1
"
,
"
a
d
m
i
n
"
: f
a
l
s
e
}
H
M
A
C
S
H
A
2
5
6
(
b
a
s
e
6
4
U
r
l
E
n
c
o
d
e
(
h
e
a
d
e
r
) + "
.
" +
b
a
s
e
6
4
U
r
l
E
n
c
o
d
e
(
p
a
y
l
o
a
d
)
,
s
e
c
r
e
t
)

How do I apply this idea to server‑to‑
server communication?

P
O
S
T /
a
p
i
/
s
e
s
s
i
o
n H
T
T
P
/
1
.
1
H
o
s
t
: 5
4
.
1
9
4
.
1
2
6
.
1
6
1
C
o
n
n
e
c
t
i
o
n
: k
e
e
p
-
a
l
i
v
e
C
o
n
t
e
n
t
-
L
e
n
g
t
h
: 3
1
A
c
c
e
p
t
: *
/
*
O
r
i
g
i
n
: h
t
t
p
:
/
/
5
4
.
1
9
4
.
1
2
6
.
1
6
1
X
-
R
e
q
u
e
s
t
e
d
-
W
i
t
h
: X
M
L
H
t
t
p
R
e
q
u
e
s
t
U
s
e
r
-
A
g
e
n
t
: M
o
z
i
l
l
a
/
5
.
0 (
M
a
c
i
n
t
o
s
h
; I
n
t
e
l M
a
c O
S X 1
0
_
1
2
_
0
) A
p
p
C
o
n
t
e
n
t
-
T
y
p
e
: a
p
p
l
i
c
a
t
i
o
n
/
j
s
o
n
R
e
f
e
r
e
r
: h
t
t
p
:
/
/
5
4
.
1
9
4
.
1
2
6
.
1
6
1
/
l
o
g
i
n
A
c
c
e
p
t
-
E
n
c
o
d
i
n
g
: g
z
i
p
, d
e
f
l
a
t
e
A
c
c
e
p
t
-
L
a
n
g
u
a
g
e
: e
n
-
U
S
,
e
n
;
q
=
0
.
8
,
n
l
;
q
=
0
.
6
C
o
o
k
i
e
: J
S
E
S
S
I
O
N
I
D
=
3
7
A
A
2
A
8
5
6
9
3
E
2
5
5
3
1
5
D
5
3
2
C
8
4
5
F
D
E
4
7
B
{
"
u
s
e
r
n
a
m
e
"
:
"
a
"
,
"
p
a
s
s
w
o
r
d
"
:
"
a
"
}

http://docs.aws.amazon.com/AmazonS3/latest/API/sig‑v4‑header‑
based‑auth.html

G
E
T ?
l
i
f
e
c
y
c
l
e H
T
T
P
/
1
.
1
H
o
s
t
: e
x
a
m
p
l
e
b
u
c
k
e
t
.
s
3
.
a
m
a
z
o
n
a
w
s
.
c
o
m
A
u
t
h
o
r
i
z
a
t
i
o
n
: S
i
g
n
a
t
u
r
e
T
o
B
e
C
a
l
c
u
l
a
t
e
d
x
-
a
m
z
-
d
a
t
e
: 2
0
1
3
0
5
2
4
T
0
0
0
0
0
0
Z
x
-
a
m
z
-
c
o
n
t
e
n
t
-
s
h
a
2
5
6
:
e
3
b
0
c
4
4
2
9
8
f
c
1
c
1
4
9
a
f
b
f
4
c
8
9
9
6
f
b
9
2
4
2
7
a
e
4
1
e
4
6
4
G
E
T
/
l
i
f
e
c
y
c
l
e
=
h
o
s
t
:
e
x
a
m
p
l
e
b
u
c
k
e
t
.
s
3
.
a
m
a
z
o
n
a
w
s
.
c
o
m
x
-
a
m
z
-
c
o
n
t
e
n
t
-
s
h
a
2
5
6
:
e
3
b
0
c
4
4
2
9
8
f
c
1
c
1
4
9
a
f
b
f
4
c
8
9
9
6
f
b
9
2
4
2
7
a
e
4
1
e
4
6
4
x
-
a
m
z
-
d
a
t
e
:
2
0
1
3
0
5
2
4
T
0
0
0
0
0
0
Z
h
o
s
t
;
x
-
a
m
z
-
c
o
n
t
e
n
t
-
s
h
a
2
5
6
;
x
-
a
m
z
-
d
a
t
e
e
3
b
0
c
4
4
2
9
8
f
c
1
c
1
4
9
a
f
b
f
4
c
8
9
9
6
f
b
9
2
4
2
7
a
e
4
1
e
4
6
4
9
b
9
3
4
c
a
4
9
5
9
9
1
b
7
8
5
2
b
8
5

See for yourself
https://github.com/ljpengelen

jwt.pdf

Recommended

Recommended

More Related Content

Similar to jwt.pdf

Similar to jwt.pdf (20)

Recently uploaded

Recently uploaded (20)

jwt.pdf