gitcommitshow / Auth Jwt

A demo to learn JWT by reverse engineering

How To Use It

1. Head over to the demo hosted on repl.it (Or run it on your local machine : clone repo -> npm install -> npm start)
2. Play around with the configurations
3. Read the cues at every page with more resources to go deeper into concepts

Documentation

If you want to extend code for more functionalities, checkout the documentation

References

About Tokens

• JWT
• JWT vs Opaque tokens

Cryptography

• Assymetric Cryptography
• Digital Signatures : Verifying authenticity of message
• Forward Secrecy : A way to protect against future compromises of private key
• Encryption vs Signing
• Encryption vs Encoding
• Hashing vs Encoding cs Encryption vs Obfuscation

Invalidating JWT

• Strategies to invalidate jwt - SO Q&A

• Simply remove the token from the client
• Create a token blacklist
• Just keep token expiry times short and rotate them often
• Contingency Plans : allow the user to change an underlying user lookup ID with their login credentials

A common approach for invalidating tokens when a user changes their password is to sign the token with a hash of their password. Thus if the password changes, any previous tokens automatically fail to verify. You can extend this to logout by including a last-logout-time in the user's record and using a combination of the last-logout-time and password hash to sign the token. This requires a DB lookup each time you need to verify the token signature, but presumably you're looking up the user anyway.

• Discussion: Is refreshing an expired JWT token a good strategy?

Securtity Risks

• JWT attack - signature as MAC
• Recreating JWT validation bypass
• 3 JWT design flaws

Implementations(Examples/Demos)

• Demo: How Docusign APIs auth workflow using JWT access token and refresh tokens
• JWT Authentication & Authorization in NodeJs/Express & MongoDB REST APIs(2019)
• JWT+Passport
• JWT+Passport : Code
• JWT+Passport : Guide on DO
• Passport-jwt
• Refreshing token using node-jsonwebtoken

Other Useful Tools

• Encode or Decode JWTs