Web Authentication

authentication jwt security web-token
Created on 2016-10-05 Last Modified 2018-06-26

Notes

Authentication Protocols

Access-Control-Allow-Origin: * does not allow requests to supply credentials like HTTP authentication, client-side SSL certificates, or cookies. ?

Server Based

Server generates session token and send to client via cookie. The session token acts as a bearer token and is used to look up login/session info in memory or datastore.

Asymmetric Key

Token Based

“Server Based” and “Token Based” could be a misnomer. Some articles says server-based auth bind a client to a specific server but this is not actually true. We can setup a in-memory datastore shared by a bunch of app servers to look up the token upon a client request. And tokens in token-based auth may as well be stored in cookies. It’s just that all session info are embedded in the token in token-based auth.

There are three ways to send your access token in a request.

  • In an HTTP Authorization header (always works)
  • In the URL query string (only works with GET requests)
  • In the request body (only works for POST & PUT when body is URL-encoded)

Bearer token clients

Questions

Token based auth allows for RBAC (Role-Based Access Control), but other method can support RBAC as well (with a session lookup)

replay attack with bearer token OAuth 2.0 (without Signatures) is Bad for the Web | hueniverse - OAuth Bearer Tokens are a Terrible Idea | hueniverse - auth0/node-auth0: Node.js client library for the Auth0 platform. - node-auth0/examples/nodejs-regular-webapp at master · auth0/node-auth0 - node-auth0/examples/nodejs-api at master · auth0/node-auth0 - auth0/cookie-jwt-auth why store back to cookie? - auth0/spa-jwt-authentication-tutorial - JavaScript - Adding authentication to your React Flux app - repo - Critical vulnerabilities in JSON Web Token libraries

vs OAuth

OAuth vs JWT vs OpenID OAuth2 token is opaque, JWT can be used JWT: 2 years later - OAuth 2 VS JSON Web Tokens: How to secure an API - Seedbox Technologies | Les Technologies Seedbox - 谈谈OAuth1,OAuth2异同 | Litten的博客 - 兔子，胡萝卜与OAuth的故事 | Litten的博客

Single Sing On (SSO)

OAuth1

OAuth2

In the Wild

boo OAuth2

Libraries

And much more…

JWT

JWT = header.claim.signature

var myHeaders = {
    "alg": "HS256", //denotes the algorithm (shorthand alg) used for the  signature is HMAC SHA-256
    "typ": "JWT" //denotes the type (shorthand typ) of token this is
}

var myClaims = {
    "sub": "tom@stormpath.com",
    "name": "Tom Abbott",
    "role": "user"
}

var headers = base64URLencode(myHeaders);
var claims = base64URLencode(myClaims);
var payload = header + "." + claims;

var signature = base64URLencode(HMACSHA256(payload, secret));

var encodedJWT = payload + "." + signature;

Demo with Express

JWT primer, tips for security

Oz

comments powered by Disqus