Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [jwt]

JWT specifies JSON web tokens. It is defined in RFC 7519: JSON Web Token (JWT)

0
votes
0answers
14 views

Is it possible to verify the requesting user for a REST transaction secured by JWT at a later date? [migrated]

I have a React (Javascript) single-page application that authenticates users via username/password/MFA to Keycloak, receives a signed JWT upon successful authentication, and then uses that JWT to call ...
0
votes
0answers
9 views

Get modulus of ssh-rsa public key? [migrated]

I'm trying to verify a JWT on client side with Auth0's library idtoken-verifier and am getting thrown an error when checking modulus and exponent of my public key (https://github.com/auth0/idtoken-...
1
vote
1answer
65 views

Are there any security drawbacks for simply encrypting and MACing my JWS token (JWT)?

This question, while related, doesn't answer the security aspect I have in mind. I understand that signatures make it impossible for the tokens to be modified. But if I want the JWS token content to ...
3
votes
4answers
349 views

JWT Login Security

I am new to security and I am wondering if JWT is secure enough. From what I have read online the flow goes like this: Clients log in by sending their credentials to the identity provider. The ...
1
vote
3answers
165 views

Base64 encoding of strings

I have read everywhere that base64 encoding of unique binary/hex values results in unique output. The following two string encode to virtually the same output. ...
2
votes
1answer
2k views

How can one validate with a public key a JWT signature generated with a private key?

As I understand it, a JSON Web Token (JWT) consists of 3 parts: the header, specifying the hashing algorithm to use for the signature; the payload itself; and the signature, which is a hash of the ...
2
votes
1answer
1k views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user ID and Unix timestamp. Now, I tried to use AES-128-GCM, ...
1
vote
1answer
75 views

Is symmetric encryption with a key containing the userId passes as authentication?

The scenario: There is a web application where ownership check is time expensive so during the development all users were able to access all other user's objects (let's say apples) by changing the ...
2
votes
1answer
2k views

HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication

Which algorithm is recommended to use when encoding / decoding JWT web application tokens? Is using HMAC-SHA256 enough or would using ...
1
vote
1answer
277 views

sign data and append certificate VS sign data and certificate

I am currently writing my masters thesis in which I need to develop a licensing module for an application. The license itself is a JSON Web Token which is signed using a RSA private key. Since we ...
2
votes
1answer
345 views

JWT Common Practices

I had a few questions in regards to certain practices used by JWT developers. I'm relatively new to both encryption and JWTs and the context given is for developing a system on nodejs. How should ...
3
votes
1answer
556 views

Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
21
votes
2answers
8k views

HMAC vs ECDSA for JWT

I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
7
votes
1answer
3k views

what are the advatanges and disavantages of the digital signature algorithms for JWT?

I am using a Java JWT library jose4j. There is a list of digital signatures algorithms which can be used. HMAC using SHA-2 RSASSA-PKCS1-V1_5 Digital Signatures with with SHA-2 Elliptic Curve Digital ...
1
vote
2answers
440 views

Padding to increase entropy and size of (otherwise) small JSON objects

Maybe this better fits, the security stackexchange... I'm building a web API. We want to enable some relatively simple encryption, instead of going full-blown OAuth2 (which frankly, IMO, sucks). So I ...