CODEWITHSUNDEEP
httpauthenticationjwtrestful-authenticationbearer-token
Gaurav Singh
Gaurav Singh

Reputation: 307

Authentication-Info header for Bearer (JWT) Auth Scheme

I am using JWT Bearer authentication scheme in a REST api. For returning jwt token to client after successful authentication, currently i am using access token response in body as described in https://www.rfc-editor.org/rfc/rfc6750#page-10

{
   "access_token":"mF_9.B5f-4.1JqM",
   "token_type":"Bearer",
   "expires_in":3600,
   "refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA"
 }

But need to return token in other HTTP request too like signup where body is already present. So, was thinking of using "Authentication-Info" header for it. But Bearer Scheme does not specify "Authentication-Info" header anywhere. Should i use Authentication-Info header for returning jwt token?

Not using OAuth 2.0, just JWT.

Upvotes: 2

Views: 1619

Answers (1)

Mika Sundland
Mika Sundland

Reputation: 18969

What you have there might be correct for OAuth 2.0, but for ordinary JWT it's much simpler. When you use ordinary self-made JWT, the client will put the token on an HTTP header called Authorization. The value of the header is something like this

Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ

The header field could be called something else too. The server and client has to agree on the name. Authorization is just the most common name.

The server will usually issue the token by responding to the POST request on the login endpoint. The token can be a part of the response body when the login is successful. The client will store the token and send the token with every request by using the header above. You can forget everything that has to do with access token and refresh token. When using "ordinary" basic JWT you will only have one token, and that is the value after Bearer.

I don't see any reason to issue a token when the user is signing up. They can get it when they log in after signing up.

I would recommend you to read this over the RFCs for OAuth if you're just implementing ordinary authentication.

Upvotes: 0

Related Questions