Does this JWT implementation prevent XSS and CSRF attacks while still giving me access to payloads?

user_6569212 0
Viewed 368

I'm implementing JWT authentication and authorization for my web app and could use some help on identifying holes in my approach. I've seen many approaches that simply say to set the access token as an httpOnly cookie, however, there are claims in my access token that my frontend needs access to. I came up with this approach to solve that.

On login, the user provides a username and password in exchange for a couple of items:

  1. A CSRF token
  2. The header and signature of the JWT access token
  3. The payload of the JWT access token
  4. A JWT refresh token

In my approach, all these items are set as cookies. The JWT refresh token and the header and signature of the JWT access token are all stored at httpOnly, secure cookies. The payload of the JWT access token is just stored as a regular old cookie so that my frontend has access to it (I'm not storing any personal/insecure information in this token).

For example, if my JWT access token is header.payload.signature, then I split my access token into header.signature and payload. These values are stored in their respective cookies.

Come time to make a request that requires authorization, my backend grabs all the JWT access token cookies, puts them back together, and then checks the signature.

Does this approach mitigate XSS and CSRF attacks while still providing secure access to the JWT payload?

jwt
2 Answers

It doesn't sound like this would work. Fundamentally, anything your code can access, so can attacker code. So, you don't want anything "my frontend has access to". The only combination that gives best coverage, as I see it:

  • HttpOnly+Secure+SameSite cookies (Mozilla docs)
  • Use CSRF tokens to protect POST/PUT/DELETE
  • Content Security Policy to guard against injected scripts

Beyond that, simpler is better. Trying to roll a clever solution is recipe for bad things.

user_24117130

JWT Token is used for authentication. Its generated and it is stored in the client and when it gets expired new token is issued.

CSRF can be of different types based on session based or request based.

I dont think JWT can replace CSRF,XSS

user_51569990
Related