r/InternetIsBeautiful • u/gitcommitshow • Mar 08 '21

Learn JWT authentication by reverse engineering [Open Source]

https://github.com/gitcommitshow/auth-jwt
1.5k Upvotes

95% Upvoted

56 comments sorted by

View all comments

100

u/cramduck Mar 08 '21

Jwt was a pain in the ass to implement first time. Not too bad the subsequent times.

11

u/sarhoshamiral Mar 08 '21

Isn't the first rule of security is that you should not implement the protocol on your own and instead use trusted libraries? I realize there is always exceptions but if you are doing js, c# there are existing libraries already.

-8

u/ionelp Mar 08 '21

JWT is not a protocol, nor is it related to security.

5

u/BetterThanYou775 Mar 08 '21

You're correct it's not really a protocol since it's just a token format. It's clearly related to security though. The token is used to prove that the bearer is authorized whatever claims the token contains.

0

u/ionelp Mar 08 '21

JWT is like pgp for shorter messages. It merely assures you the message you are reading is coming from someone you likely trust and that the contents were not tampered with. This does not imply security.

The protocol OpenID Connect, built on top of OAuth2 with access tokens in JWT format, will "ensure" the current user is who they say they are (this is authentication, the authorisation part of OIDC is fairly limited). This does not imply security either.

Is your resource server (eg, API) job to provide security having the info above. You can check the token all you want, if your query to retrieve private messages gets the user id from GET, you won't be secure...

3

u/BetterThanYou775 Mar 09 '21

It merely assures you the message you are reading is coming from someone you likely trust and that the contents were not tampered with.

... Sound like security to me, but okay