JSON Web Tokens should be avoided

Re:JSON Web Tokens should be avoided by unscaled on Tuesday March 14, 2017 @01:08PM (#13869365)

You should also make sure to allow only tokens with the "HS256" alg headers before you verify them, in case somebody decides to add a new signature algorithm to your library, and it turns out it could easily be broken and lets you use the same key you used for HS256.

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by tracker1 on Tuesday March 14, 2017 @01:27PM (#13869563)

If it's your software generating the tokens, then that means they'd need the shared key, or private key in order to sign the token... which is already a problem. Now if you're accepting tokens from a third party, that's another issue, and should be much more constrained.

I go farther still and require a VERY short expiration on service to service requests (documented as 1m, coded as 2m) which combined with https limits the chance of replay attacks.

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by bgentry on Tuesday March 14, 2017 @01:15PM (#13869442)

yes, that's another good point and probably something many folks mess up. I am explicitly specifying my algorithm for both encode/decode :)

[ Parent | on HN ]