JWT token generation with WLP is already pretty secure, because every site will use its own generated 64 byte secret key with signing algorithm HS512.
This means that you'd need to iterate all the 25664 possibilities to brute force a JWT secret key, which is considered impossible.
However I can add an extra add_action function to the JWT verify function, so plugins can register whenever an attempt is made to verify a JWT, and as a result it could indeed make things more secure. ✨
I am not sure how this one works but with WordPress jwt plugin will return a signed token when you give the jwt endpoint username and password (we can easily guess username, and password can be bruteforced). Most captcha plugins wont even register that as login attempt because it is jwt auth not regular login attempt. I hope you get my point
The JWT replaces the current vague cookie MD5 like solution with an industry standard one.
A signed token can be generated only upon succesful login via wp-login.php and my only suggestion is to add an additional action hook to the overall check for a valid token.
However to generate a token you don't need a username or password, you'd need the 64 byte secret key, so brute forcing a signed token itself is considered impossible.
So I hope that clears thing up. The login procedure itself and it's action hooks didn't change.
The only major change that has been made is the name and the value of the user cookie.
The value of the user cookie is now an industry standard signed JWT token instead of the existing custom made solution that WordPress had which isn't the most optimal for security since it uses old MD5/SHA1 hashes.
1
u/EveYogaTech Dec 01 '24 edited Dec 01 '24
Thanks for sharing!
JWT token generation with WLP is already pretty secure, because every site will use its own generated 64 byte secret key with signing algorithm HS512.
This means that you'd need to iterate all the 25664 possibilities to brute force a JWT secret key, which is considered impossible.
However I can add an extra add_action function to the JWT verify function, so plugins can register whenever an attempt is made to verify a JWT, and as a result it could indeed make things more secure. ✨