JSON Web Tokens

JSON Web Token (JWT) is a compact, URL-safe means of representing
claims to be transferred between two parties. The claims in a JWT
are encoded as a JSON object that is used as the payload of a JSON
Web Signature (JWS) structure or as the plaintext of a JSON Web
Encryption (JWE) structure, enabling the claims to be digitally
signed or integrity protected with a Message Authentication Code
(MAC) and/or encrypted.

Transcript

1. JWT Vinicius Souza @vsouza
2. Authentication != Authorization
3. “JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure, enabling the claims to be digitally signed or integrity protected with a Message Authentication Code (MAC) and/or encrypted.” The suggested pronunciation of JWT is the same as the English word "jot". http://tools.ietf.org/html/rfc7519
4. Structure eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOiIxMjM0NTY3ODkwIn0.mfxaJGU K-PkqBpPdO55FpXInVh7nWgxbkWaXcoRWtcQ
5. Header eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 “typ”: (string) Type for the token, defaulted to "JWT". Specifies that this is a JWT token “alg”: (string) Algorithm. specifies the algorithm used to sign the token. ['HS256', 'HS384', 'HS512', 'ES256', 'ES384', 'ES512', 'RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512'] { "typ": "JWT", "alg": "HS256" }
6. Claims eyJleHAiOiIxMjM0NTY3ODkwIn0 • iss: The issuer of the token • aud: The audience that the JWT is intended for • iat: The timestamp when the JWT was created (issued at) • nbf: "not process before" timestamp defining an allowed start time for processing • exp: A timestamp defining an expiration time for the token • jti: Some kind of unique ID for the token • custom: ….
7. { “iss”: “google.com”, “aud”: “hi@vsouza.com”, “iat”: 1434707600, // 09:53hrs de hoje “nbf”: 1434722400, // 14:00hrs de hoje “exp”: 1434736800, // 18:00hrs de hoje “jti”: “dbe1a28a-1497-11e5-b60b-1697f925ec7b”, “from_newsletter”: true, }
8. Signature mfxaJGUK-PkqBpPdO55FpXInVh7nWgxbkWaXcoRWtcQ ECMACSHA256( base64UrlEncode(header) + “.” + base64UrlEncode(payload), “saudadeDaComidaDaDonaNilda” //SECRET )
9. Why JOT ? • Mobile ready • CSRF • Standard-base • stateless (easy to scale) • reusability • security • performance
10. • .NET • Python • Node.JS • Java • Javascript • PHP • Ruby • Golang • Java • Haskell • Rust • Lua Support
11. How ?
13. Python import jwt encoded = jwt.encode(claims, “saudadeDaComidaDaDonaNilda”, algorithm='HS256') 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzb21lIjoicGF5bG9hZCJ9.4twFt5Ni znN84AWoo1d7KO1T_yoc0Z6XOpOVswacPZg' jwt.decode(encoded, “saudadeDaComidaDaDonaNilda”, algorithms=['HS256']) {u'some': u'payload'} github.com/jpadilla/pyjwt
14. Golang token := jwt.New(jwt.SigningMethodHS256) token.Claims["iss"] = "google.com" token.Claims["exp"] = time.Now().Add(time.Hour * 72).Unix() tokenString, err := token.SignedString("saudadeDaComidaDaDonaNilda") token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) { if _, ok := token.Method.(*jwt.SigningMethodRSA); !ok { return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"]) } return myLookupKey(token.Header["kid"]) }) if err == nil && token.Valid { fmt.Println("WELCOME!") } else { fmt.Println("bye!") } github.com/dgrijalva/jwt-go
15. eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOiIxMjM0NTY3ODkwIn0.mfxaJG UK-PkqBpPdO55FpXInVh7nWgxbkWaXcoRWtcQ “saudadeDaComidaDaDonaNilda” jwt.io </end>