CODEWITHSUNDEEP
node.jssecurityjwt
Pete
Pete

Reputation: 10918

JWT authentication with two different services

We have a service architecture that currently only supports client authentication. A Java service based on spring boot and spring security issues long lived JWT based on tenants for other services to authenticate against each other. For example a render service needs to get templates from the template service. We now want to build a user service with node.js that issues short lived tokens for users to also access some of those services and only access the resource visible to the user. For example the user wants to see only their templates in a list.

My question is: what do I need to watch out for when implementing the /auth resource on the user service? I have managed to issue a JWT with the required information and obviously the same secret in the user service to access the template service. But I'm not sure if it is secure enough. I had to add a random JID to the user JWT to get it accepted by the template service (which is also implemented with spring boot).

Is there a security issue I need to watch out for? Is this approach naiive?

This is my javascript code that issues the JWT:

const jwt = require('jwt-simple');
const secret = require('../config').jwtSecret;
const jti = require('../config').jti;

// payload contains userId and roles the user has
const encode = ({ payload, expiresInMinutes, tenantId}) => {
  const now = new Date();
  payload.jti = jti; // this is a UUID - spring security will otherwise not accept the JWT
  payload.client_id = tenantId; // this is required by the template service which supports tenants identified through their clientId
  const expiresAt = new Date(now.getTime() + expiresInMinutes * 60000);
  payload.expiresAt = expiresAt;
  return jwt.encode(payload, secret);
};

I think of adding some type information to the user JWT so that those java services that do not allow any User access can directly deny access for all user JWTs. Or maybe I can use the JTI here? Will research how spring boot handles that. I'll probably also have to add @Secured with a role distinction to all the services that allow user access to only some resources. But those are technical details. My concern really is that I am unsure about wether the entire concept of using JWTs issued from different sources is secure enough or what I have to do in the user service to make it so.

Upvotes: 0

Views: 909

Answers (1)

Nitzy
Nitzy

Reputation: 260

Yeah your concept is right since you are the owner of jwt that means only you can write the jwt, others can read it but can not modify it.

So your userservice will create the token with certain information like userid and another service will decode that jwt fetch userid and validate that userid

Upvotes: 2

Related Questions