Spring Boot Security With JWT Token Tricks and Best Practices

user_3278822 0
Viewed 40

Looking for a good explanation for to following: Once we identify a user (by any of the safe methods) we can generate a JWT token ang give it back to the user to identify themselves for a limited time without having to re-authenticate.

  • How do we ensure that the correct user is using the correct token. Example, what if user 2 stole the token of user 1, or what is not a user stole the token of user 1. Are we blindly going to trust the token? How to protect from this case?

  • What if user 1 grabs the token and modifies it to add some extra privileges? How to protect from this case?

Let's assume token is served in a cookie and it is not httpOnly, since UI needs to read (or decode) the content to grab some of the information from it's content.

single-page-application jwt spring-boot
1 Answers

Are we blindly going to trust the token?

Yes, it's the principle of a bearer token. If someone stole it, he can impersonate the regular user. Against this, there is two mechanisms:

  1. The token has a lifetime that can be relatively short.
  2. In some implementations, the token can be revoked.

What if user 1 grabs the token and modifies it to add some extra privileges?

The token is signed with a cryptographic algorithm. If you modified it, it's signature would become invalid.

user_18076670
Related