I'm making a secure rest service and I've already secured it using basic auth plus a jwt token that's obtained before, am I making the security too strong or it's that a necessary path to follow?
1 Answers
Using both HTTP Basic auth and JWT token does not make the application more secure, it actually makes it less secure and more complex to handle.
HTTP Basic auth is done by the user agent (usually a browser). It permanently adds the Authorization: Basic <payload> header to every request. You can not log out. It will be there unless you close the agent. The only good thing is that this authentication can be invalidated. And we usually don't use this authentication for humans, but for microservices only due to the poor handling in the browsers (forget to close the tab and log out and you're done if someone gets physical access to your computer).
JWT is a bit better. It can expire. But can not be invalidated (without setting up additional infrastructure at least).
Now what you get is the worst of the two worlds. You can not log out. If your JWT token expires it will be regenerated as you still have Basic Auth. If you invalidate basic auth, you might (maybe - would need to check it to be 100% sure) still access the app using the JWT token until it expires.
Do not take my word for that. Just check if after the JWT token expires, you still can access the app and what happens with the JWT token then.
I once had basic auth and normal authentication using JSESSIONID. The mix did not work either.
Related