6 Self-contained tokens and JWTs

 

This chapter covers

  • Scaling token-based authentication with encrypted client-side storage
  • Protecting tokens with MACs and authenticated encryption
  • Generating standard JSON Web Tokens
  • Handling token revocation when all the state is on the client

You’ve shifted the Natter API over to using the database token store with tokens stored in Web Storage. The good news is that Natter is really taking off. Your user base has grown to millions of regular users. The bad news is that the token database is struggling to cope with this level of traffic. You’ve evaluated different database backends, but you’ve heard about stateless tokens that would allow you to get rid of the database entirely. Without a database slowing you down, Natter will be able to scale up as the user base continues to grow. In this chapter, you’ll implement self-contained tokens securely, and examine some of the security trade-offs compared to database-backed tokens. You’ll also learn about the JSON Web Token (JWT) standard that is the most widely used token format today.

Definition

JSON Web Tokens (JWTs, pronounced “jots”) are a standard format for self-contained security tokens. A JWT consists of a set of claims about a user represented as a JSON object, together with a header describing the format of the token. JWTs are cryptographically protected against tampering and can also be encrypted.

6.1 Storing token state on the client

6.1.1 Protecting JSON tokens with HMAC

6.2 JSON Web Tokens

6.2.1 The standard JWT claims

6.2.2 The JOSE header

6.2.3 Generating standard JWTs

6.2.4 Validating a signed JWT

6.3 Encrypting sensitive attributes

6.3.1 Authenticated encryption

6.3.2 Authenticated encryption with NaCl

6.3.3 Encrypted JWTs

6.3.4 Using a JWT library

6.4 Using types for secure API design

6.5 Handling token revocation

6.5.1 Implementing hybrid tokens

Answers to pop quiz questions

Summary

sitemap