CODEWITHSUNDEEP
javascriptjwt
Stan Luo
Stan Luo

Reputation: 3889

Can a Json Web Token be faked or impersonated?

I have get the JWT authentication up and running in my react-native project. Now every request I make, token will be included in header as authorization.

To my understanding, when the server receives my token, it will be decoded into something like:

{ sub: user.id, iat: timestamp, email: user.email }

Then the server will recognize me based on that user.id.

But since there's only the token included in the header, no userId in the header, how can the server know that I am really the one with that id? Say a hacker got my token, then can he fake as me and talk to the server?

Upvotes: 2

Views: 1624

Answers (1)

Robert Harvey
Robert Harvey

Reputation: 180808

The usual way to prevent such tokens from being stolen in-transit is via Transport Level Security, specifically SSL. The HTTPS connection is established first, before tokens are exchanged between the two systems.

There are potentially other solutions that can also be used to prevent token theft, such as Token Binding Protocol and Proof Key for Code Exchange by OAuth Public Clients.

To provide additional security, tokens are often time-limited. Reference Tokens can be revoked on demand, without having to wait for them to time out.

Upvotes: 3

Related Questions