Should I Use jwts For Authentication Tokens?

Re:Should I Use jwts For Authentication Tokens? by chipdart on Monday May 27, 2024 @04:06PM (#40494148)

> The audience and scope claims exist to address that problem. Provided that RPs reject JWTs issued for other audiences than themselves there’s no security weakness here.

My interpretation is that the audience and scope claims, as other features like nonce, are in place to prevent tokens from being intercepted and misused, not to facilitate passing tokens around.

[ Parent | on HN ]

Re:Should I Use jwts For Authentication Tokens? by Aeolun on Monday May 27, 2024 @07:34PM (#40495827)

Don’t see how those prevent tokens from being misused? They just prevent anyone from issuing tokens as you. Not by themselves, but if you implement your server correctly.

[ Parent | on HN ]

Re:Should I Use jwts For Authentication Tokens? by chipdart on Tuesday May 28, 2024 @01:28AM (#40497593)

> Don’t see how those prevent tokens from being misused?

The purpose of a nonce is to explicitly prevent the token from being reused.

The purpose of the other claims is to prevent them from being accepted (and used) in calls to other services.

If you implement your server correctly, each instance of each service is a principal which goes through auth flows independently and uses its own tokens.

There is no token sharing.

[ Parent | on HN ]