JWT, WTF? at London Web Standards

Slide 1

Slide 1 text

JWT, WTF?

Slide 2

Slide 2 text

Phil Nash @philnash http:/ /philna.sh [email protected] @philnash

Slide 3

Slide 3 text

EMOJIS! @philnash

Slide 4

Slide 4 text

ARE YOU READY FOR SOME ABBREVIATIONS?

Slide 5

Slide 5 text

JWT @philnash

Slide 6

Slide 6 text

JSON WEB TOKEN @philnash

Slide 7

Slide 7 text

RFC 7519 @philnash

Slide 8

Slide 8 text

"JOT" @philnash

Slide 9

Slide 9 text

THERE'S MORE

Slide 10

Slide 10 text

JWS JWE JWK JWA @philnash

Slide 11

Slide 11 text

RFCS 7515 7516 7517 7518 @philnash

Slide 12

Slide 12 text

JOSE @philnash

Slide 13

Slide 13 text

RFC 7520 @philnash

Slide 14

Slide 14 text

AAARGH @philnash

Slide 15

Slide 15 text

LET'S START AGAIN

Slide 16

Slide 16 text

WHAT'S A JWT?

Slide 17

Slide 17 text

JWT “JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties.” @philnash

Slide 18

Slide 18 text

JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. eyJzdWIiOiJwaGlsbmFzaEB0d2lsaW8uY29tIn0. l9vi8Dt8Pds3QTBqNMnQGU0wDDWDv46RFIcqeOIPqDk @philnash

Slide 19

Slide 19 text

JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. eyJzdWIiOiJwaGlsbmFzaEB0d2lsaW8uY29tIn0. l9vi8Dt8Pds3QTBqNMnQGU0wDDWDv46RFIcqeOIPqDk @philnash

Slide 20

Slide 20 text

JWT { "alg": "HS256", "typ": "JWT" } { "sub": "[email protected]" } @philnash

Slide 21

Slide 21 text

@philnash

Slide 22

Slide 22 text

HOW DO THEY WORK?

Slide 23

Slide 23 text

CREATING A JWT @philnash

Slide 24

Slide 24 text

Creating a JWT const header = { "alg": "HS256", "typ": "JWT" } const payload = { "sub": "[email protected]" } @philnash

Slide 25

Slide 25 text

ENCODE THE HEADER AND PAYLOAD @philnash

Slide 26

Slide 26 text

Base64url encodedHeader = new Buffer(JSON.stringify(header)) .toString('base64') .replace(/=/g, "") .replace(/\+/g, "-") .replace(/\//g, "_"); @philnash

Slide 27

Slide 27 text

Base64url encodedPayload = new Buffer(JSON.stringify(payload)) .toString('base64') .replace(/=/g, "") .replace(/\+/g, "-") .replace(/\//g, "_"); @philnash

Slide 28

Slide 28 text

SIGN THE ENCODED HEADER AND PAYLOAD @philnash

Slide 29

Slide 29 text

HMAC SHA256 const crypto = require('crypto'); const hmac = crypto.createHmac('sha256', 'secret'); hmac.update(`${encodedHeader}.${encodedPayload}`); const signature = hmac.digest('base64'); @philnash

Slide 30

Slide 30 text

The ﬁnished JWT eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. eyJzdWIiOiJwaGlsbmFzaEB0d2lsaW8uY29tIn0. l9vi8Dt8Pds3QTBqNMnQGU0wDDWDv46RFIcqeOIPqDk @philnash

Slide 31

Slide 31 text

VERIFYING A JWT @philnash

Slide 32

Slide 32 text

Verifying a JWT [ encodedHeader, encodedPayload, signature ] = jwt.split('.'); @philnash

Slide 33

Slide 33 text

Decode the header const decodedHeader = JSON.parse( new Buffer(encodedHeader, 'base64').toString('ascii') ) @philnash

Slide 34

Slide 34 text

Decode the payload const decodedPayload = JSON.parse( new Buffer(encodedPayload, 'base64').toString('ascii') ) @philnash

Slide 35

Slide 35 text

HMAC SHA256 const crypto = require('crypto'); const hmac = crypto.createHmac('sha256', 'secret'); hmac.update(`${encodedHeader}.${encodedPayload}`); const generatedSignature = hmac.digest('base64'); @philnash

Slide 36

Slide 36 text

Compare secureCompare(signature, generatedSignature); @philnash

Slide 37

Slide 37 text

JWT Playground https:/ /jwt.io @philnash

Slide 38

Slide 38 text

PITFALLS

Slide 39

Slide 39 text

DATA IS PUBLIC @philnash

Slide 40

Slide 40 text

SIGNING ALGORITHM @philnash

Slide 41

Slide 41 text

JWT { "alg": "HS256", "typ": "JWT" } { "sub": "[email protected]" } @philnash

Slide 42

Slide 42 text

JWT { "alg": "none" , "typ": "JWT" } { "sub": "[email protected]" } @philnash

Slide 43

Slide 43 text

ALWAYS VERIFY WITH AN EXPECTED ALGORITHM @philnash

Slide 44

Slide 44 text

PUBLIC KEYS AND ENCRYPTION @philnash

Slide 45

Slide 45 text

WHAT CAN YOU USE THEM FOR?

Slide 46

Slide 46 text

STATELESS SESSIONS @philnash

Slide 47

Slide 47 text

Stateless sessions - revocation • exp claim - token expiry time • Without state, you can't revoke individual tokens except by expiry • Requires a blacklist of revoked tokens to check against @philnash

Slide 48

Slide 48 text

Stateless sessions - storage • Cookies • ensure you have CSRF protection • localStorage • vulnerable to XSS • requires JS to store and insert as an Authentication header @philnash

Slide 49

Slide 49 text

MICROSERVICE ARCHITECTURE @philnash

Slide 50

Slide 50 text

Microservice architecture • Authentication server signs tokens with private key • Other servers can verify with public key @philnash

Slide 51

Slide 51 text

OPENID CONNECT @philnash

Slide 52

Slide 52 text

CLIENT SIDE AUTH FOR 3RD PARTY SERVICES @philnash

Slide 53

Slide 53 text

JWT, WTF?

Slide 54

Slide 54 text

JWT, WTF? • https:/ /jwt.io • RFC 7519 • JWTs VS Sessions • Stop using JWT for sessions • Use JWT the Right Way @philnash