The proper way to use JWTs for API Authorization on the web

Using JSON Web Tokens (JWTs) for API Authorization can have awesome benefits over the more traditional session-ids approach: stateless verification/authorization, cross-domain and being client-side readable, but using JWTs on the web can be contentious. There is a lot of concern (and a lot of FUD spread) about using JWTs in web apps, specifically about storing the JWT in localstorage, but luckily there is a better way...

Transcript

1. JWTs for API Authorization THE PROPER WAY TO USE ON THE WEB @adamlbarrett BigAB
5. OKAY, SO LET’S TALK ABOUT JSON-WEB TOKENS (JWT)
6. JSON-WEB-TOKENS FUD ▸ Fear ▸ Uncertainty ▸ Doubt
7. WHAT ARE THEY? JSON WEB TOKENS
8. JSON WEB TOKENS HEADER . PAYLOAD . SIGNATURE
9. JWTs
10. JWTs
11. WHAT ELSE COULD YOU USE JWTs for?
12. VS
13. AUTHORIZATION: BEARER <TOKEN> COOKIE: SESSION=<SESSIONID>;
14. WHERE TO STORE? JWTs
17. JSON WEB TOKENS LOCALSTORAGE
19. “THE IDEA IS TO REDUCE THE ATTACK SURFACE. A CODE-SPECIFIC ATTACK IS GOING TO DO MORE DAMAGE, EXPLOIT MORE HOLES, ETC. BUT A BLANKET ATTACK CAN LOOP OVER 1000 GENERIC SITES LOCALSTORAGE AND EXTRACT EVERYTHING WITHOUT NEEDING TO WRITE ANY CODE” Luke Oliff from Auth0
21. XSS is the worst… When you keep JWTs in local storage
23. JSON WEB TOKENS LOCALSTORAGE ?
24. JSON WEB TOKENS THE REAL BENEFITS OF JWTs ▸ Stateless verification/authorization ▸ Client-side readable
25. JSON WEB TOKENS THE REAL BENEFITS OF NOT USING COOKIES ▸ Cross Domain ▸ No Cross-Site Request Forgery (CSRF)
26. JSON WEB TOKENS THE REAL CONS ▸ inability to revoke a users access without revoking everyones access ▸ Easy to misuse (like localstorage)
27. JSON WEB TOKENS THE REAL BENEFITS OF SESSION COOKIES ▸ Better defended from blanket XSS ▸ Ability to revoke access ▸ Battle Hardend Assuming `httpOnly`, `secure`, and `sameSite`
28. JSON WEB TOKENS THE REAL CONS OF SESSION COOKIES ▸ vulnerable to CSRF
 (sameSite flag mitigates this) ▸ not cross-domain ▸ Not client-side readable ▸ stateful verification
29. WHICH OF THOSE BENEFITS SUITES YOUR NEEDS? The real question JSON WEB TOKENS
30. WEB APP TRADITIONAL
31. WEB APP TRADITIONAL
32. WEB APP TRADITIONAL
33. SPA / PWA SINGLE PAGE APPS
34. SPA / PWA SINGLE PAGE APPS
35. JSON WEB TOKENS BUT DON’T… Store it in localstorage Re-implement sessions Do this yourself
36. FULL DISCLOSURE Auth0 Ambassador Program
38. BUT WHAT IF YOU HAVE TO…?
39. Steps to making your SPA or JAMstack app use JWTs for authentication the right way ADAM L BARRETT’S
40. 1.
 HAVE A SEPARATE AUTH SERVICE
41. 2.
 REDIRECT OUT OF YOUR APP TO THE IDENTITY SERVICE
42. 3.
 HAVE THE AUTH SERVICE USE SESSIONS
43. 4.
 GIVE OUT ACCESS TOKENS ON SUCCESSFUL AUTHENTICATION AND AUTHORIZATION
44. 5.
 KEEP ACCESS TOKENS EXPIRY SHORT
45. 6.
 USE THE IFRAME SESSION-CHECK TECHNIQUE FOR USER EXPERIENCE
47. THE IFRAME SESSION-CHECK TECHNIQUE WHAT IS…?
48. JSON WEB TOKENS AN IFRAME FROM YOUR APP TO YOUR AUTH SERVICE… PostMessage
49. BEST OF BOTH WORDS JWTs are not in localstorage, and the UX is still good
50. JSON WEB TOKENS QUICK RECAP ▸ Storing JWTs in localstorage is bad ▸ Don’t handle auth yourself, leave it to experts ▸ Only use JWTs if you benefit from ▸ Stateless verification ▸ Client side readability ▸ Recognize and avoid both FUD and Hype
51. @adamlbarrett BigAB JWTs for API Authorization THE PROPER WAY TO USE ON THE WEB Questions?