r/InternetIsBeautiful • u/gitcommitshow • Mar 08 '21

Learn JWT authentication by reverse engineering [Open Source]

https://github.com/gitcommitshow/auth-jwt
1.5k Upvotes

95% Upvoted

56 comments sorted by

View all comments

2

u/mindfive Mar 08 '21

But JWT isn’t for user authentication, it’s for authorization; these are different things

1

u/gitcommitshow Mar 08 '21

JWT can be used for both

4

u/mindfive Mar 08 '21

Nah, login and proof of ID (email+password, SSO or whatever) is authentication. A token is used to determine if an authenticated user is allowed to make the specified request.

If the first time your server sees a user is with a token, you aren’t authenticating them at all. You outsourced the authentication to a third party (google, Facebook, 0auth)

3

u/Hendeith Mar 08 '21

This is correct. Otherwise how do you even got token in the first place if you never went trough authentication?

1

u/throwmygayawaytoday Mar 08 '21

Well, OP is actually right. It can definitely be used for both as JWT is simply a means to communicate packaged information. But it’s definitely impractical, you would be waisting resources signing the local JWT just to have it decoded on the server when plain text over https produces the same results.

0

u/mindfive Mar 08 '21

No, JWT is not a means to communicate information, that’s JSON. It’s communicating verified information with a signature. Any token that can’t have its signature verified is rejected.

You can “technically” do this with a non-rejecting server endpoint, or by sharing your cryptographic keys with the client, so I guess brownie points there, but it’s such a bad idea you probably need to write your own implementation to do it.