CODEWITHSUNDEEP
apiauthenticationjwt
JIFT
JIFT

Reputation: 81

Json Web Token + User Authentication

I just implemented Json Web Tokens to my api, but I don't understand how to verify if the user that created the token, is the one that is making the request.

For example, I have the /user/login end point, and I received the user and password for login. Then I create a json web token with the user data inside, and return it. And here is my problem, how do I know that the user that create that token, is the one that is making the request ?.

I found several ways to verify this, for example saving the user-agent + ip of the user and only accept request for that token if the user-agent + ip is xxx, but I am not really sure that is the best way.

I hope you can help me with some tips,

Thanks for all

Upvotes: 1

Views: 1235

Answers (2)

pedrofb
pedrofb

Reputation: 39241

how do I know that the user that create that token, is the one that is making the request ?.

Because the JWT includes the user ID and is signed, therefore any alterations to the content will be detected. Possession of the token is proof of authenticity

The process of issuing and authenticating with JWT is more or less like this

Issuing new JWT

  1. User performs and authentication using its credentials

  2. The server validate credentials, generate the JWT payload including the user data and some fields such as expiration time or issuer, and signs the token with server private key

  3. The client receives the token and store it (in a secure storage).

Authentication

  1. User sends a request to server. The request includes the JWT, usually in headers or as url param

  2. The server validates the signature with the key, and extracts the user ID to know the requestor. If the signature is not valid rejects the request

Upvotes: 1

Joseph Rosson
Joseph Rosson

Reputation: 354

Any reason you can't use a standard like OAUTH2 and let the big boys handle security for you? Rolling your own security is usually very difficult to get correct and almost all the major players provide free OATH support.

That said, I'd be hesitant to lead you down a bad path, however I've been in your shoes before so if you must roll your own security, make certain you fully read all of what OWASP has to offer. They offer very detailed threat analysis and also give suggestions that will be invaluable along your journey.

OWASP Threat Analysis

EDIT 1

A good light weight and easy to implement standard is OpenID which as their banner explains is,

A Simple Identity layer on top of OAuth 2.0

See here for a very detailed explanation of how it works: OpenID-Wiki

Upvotes: 0

Related Questions