JSON Web Token Authentication

An introduction to JSON Web Token (JWT) standard.

Transcript

1. JSON Web Token authentication Sergio Vera (https://github.com/svera)
2. Cookie-based vs Token based auth
3. Layman’s definition A JSON Web Token (JWT) is a passport which grants access to restricted resources.
4. Advantages • IETF Standard (draft) • Self-contained: carries all the information necessary within itself. • Scalable: No need to store it server-side. • Can be passed around easily: perfectly usable inside an HTTP header or through the URL.
5. Anatomy of a JWT aaaaa.bbbbb.ccccc Header Claims Signature
6. Anatomy of a JWT: Header A JSON which normally contains two fields: The type of the token and the algorithm name. Something like: {typ: 'JWT', alg: 'HS256'}. This gets encoded into base64.
7. Anatomy of a JWT: Claims Also called payload, is a JSON which carries the bulk of our JWT. This is where we will put the information that we want to transmit and other information about our token. Also encoded in base64.
8. Anatomy of a JWT: Registered claims • Registered in the IANA JSON Web Token Claims registry. • Act as JWT metadata. • Applications using JWTs should define which specific claims they use and when they are required or optional.
9. Anatomy of a JWT: Registered claims • iss: The issuer of the token. • sub: The subject of the token. • aud: The audience of the token. • exp: Expiration time on or after which the JWT MUST NOT be accepted for processing. • nbf: Defines the time before which the JWT MUST NOT be accepted for processing.
10. Anatomy of a JWT: Registered claims • iat: The time the JWT was issued. Can be used to determine the age of the JWT. • jti: Unique identifier for the JWT. Can be used to prevent the JWT from being replayed. This is helpful for a one time use token.
11. Anatomy of a JWT: Signature To avoid tampering, JWTs are signed. Signature is created joining the encoded header and payload with a dot, hashing the resulting string with a secret key using the algorithm specified in the header, and encoding it in base64. $encodedString = base64_encode($header).'.'.base64_encode($payload); $signature = hash_hmac('sha256', $encodedString, 'secret'); $token = $encodedString.'.'.base64_encode($signature);
12. References • http://self-issued.info/docs/draft-ietf-oauth-json- web-token.html - Official JWT standard draft. • https://github.com/namshi/jose - PHP JWT implementation. • https://auth0.com/blog/2014/12/02/using-json-web- tokens-as-api-keys • https://github.com/svera/jwt-php-test - PHP sample application.