CODEWITHSUNDEEP
javascriptjwt
Shreyansh Jain
Shreyansh Jain

Reputation: 475

Can same orgin policy prevent attack if jwt is stolen?

I read this blog What Happens If Your JWT Is Stolen? The blog says that if one gets the JWT he/she can send requests to the server on behalf of the user.

My question is:- if JWT is stolen and my website don't allow request from unknown domain (due to same origin policy), will I be safe? Is there a way to override same origin policy by the hacker.

Upvotes: 0

Views: 65

Answers (2)

Jonas Wilms
Jonas Wilms

Reputation: 138497

Your website is a server that answers HTTP(S) requests. An HTTP request is just a bunch of text in a few IP packets. Anybody connected to the Internet can send any text they want to your server. The only information in there which is reliable is the origin and target IP adress of the server and the client connecting (as otherwise the packets won't arrive). Now to ensure that a certain request comes from a certain user, you share a secret with the user, which gets send with the request. When a request arrives, this secret is the only way to authenticate the user. If someone is able to steal or guess that secret, there is no way for the server to distinguish between the user and the attacker.

my website don't allow request from unknown domain

Not quite, the browser which the user uses to store the secret the server gave to the user, ensures that the secret gets only shared with your server. If you disable cross origin sharing, code of other websites the user visits with their webbrowser is unable to perform requests to your server in the background. Thus it prevents that other code uses the secret to perform an action on your server.

In conclusion CORS policies only help to keep secrets secret, if the secret is not secret anymore they won't help.

Upvotes: 0

user15388024
user15388024

Reputation:

These policies are a set of rules for browsers. Every HTTP client like curl or Postman can "override" these policies and send custom requests. With Postman you can configure the request as you want.

Same origin policies don't protect your server from attackers. They protect users of your web application from involuntary executing malicious code.

If attackers get a valid token they can send valid requests.

"Can same orgin policy prevent attack if jwt is stolen?" No, they can't.

Upvotes: 1

Related Questions