Modern API Security with JSON Web Tokens
14 likes3,858 views
The document provides a comprehensive guide on modern API security using JSON Web Tokens (JWT), detailing their benefits over traditional authentication systems and the structure of JWT including its header, payload, and signature. It explains the differences between symmetric and asymmetric algorithms, and offers practical examples of generating, signing, and verifying JWTs. Additionally, it discusses preventing replay attacks and the integration of JWT with OAuth 2.0 for authentication and authorization purposes.
![var jwt = require('jsonwebtoken'),!
fs = require('fs');!
!
//get public key !
cert = fs.readFileSync('public.pem'); !
!
// verify asynchronously with RSA SHA256!
jwt.verify(token, cert, { algorithms: ['RS256'] }, function (err, payload) {!
console.log(payload);!
});!
Verifying JSON Web Tokens!](https://image.slidesharecdn.com/2016decconfoojwtoauth-161207204327/85/Modern-API-Security-with-JSON-Web-Tokens-24-320.jpg)
![POST /token.oauth2 HTTP/1.1!
Host: service.example.com!
Content-Type: application/x-www-form-urlencoded!
!
grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer!
&assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6IjE2In0.!
eyJpc3Mi[...omitted for brevity...].!
J9l-ZhwP[...omitted for brevity...]!
Authorization Example OAuth 2 access token request with JWT!](https://image.slidesharecdn.com/2016decconfoojwtoauth-161207204327/85/Modern-API-Security-with-JSON-Web-Tokens-35-320.jpg)
![POST /token.oauth2 HTTP/1.1!
Host: service.example.com!
Content-Type: application/x-www-form-urlencoded!
!
grant_type=authorization_code&!
code=n0esc3NRze7LTCu7iYzS6a5acc3f0ogp4&!
client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-
bearer!
client_assertion=eyJhbGciOiJSUzI1NiIsImtpZCI6IjIyIn0.!
eyJpc3Mi[...omitted for brevity...].!
cC4hiUPo[...omitted for brevity...]!
Authentication Example OAuth 2 access token request with JWT!](https://image.slidesharecdn.com/2016decconfoojwtoauth-161207204327/85/Modern-API-Security-with-JSON-Web-Tokens-36-320.jpg)
Modern API Security with JSON Web Tokens
- 1. Modern API Security with! JSON Web Tokens! Jonathan LeBlanc ! Twitter: @jcleblanc ! Book: http://bit.ly/iddatasecurity!
- 2. JSON Web Token (JWT) Specification! ! https://tools.ietf.org/html/rfc7519!
- 3. JWT Benefits! ! They’re self contained and help maintain a stateless architecture.! ! They maintain a small footprint and can be passed along easily. ! ! They work well across multiple programming languages.!
- 4. Traditional vs Token-Based Authentication Systems!
- 5. User logs in, server checks creds Session stored in sever, cookie created Send session data to access endpoints Traditional Authentication Systems
- 6. Issues with traditional systems! • Sessions: Record needs to be stored on server ! • Scalability: With sessions in memory, load increases drastically in a distributed system.! • CORS: When using multiple devices grabbing data via AJAX requests, we may run into forbidden requests.! • CSRF Attacks: Riding session data to send commands to server from a browser that is trusted via session.!
- 7. User logs in, server checks creds Token generated, store in localStorage Provide token in headers for all reqs Token-Based Authentication Systems
- 8. How JSON Web Tokens Work!
- 9. • Header: Token type and hashing algorithm! • Payload: User / verification content! • Signature: Header, payload, and secret!
- 10. XXXXXXXX.YYYYYYYY.ZZZZZZZZ! What a Signed Token will Look Like!
- 11. Authorization: Bearer <token>! Transmission of a JWT via HTTP Headers!
- 12. JWT Header! ! alg: The hashing algorithm to be used.! ! typ: The token type. Should be JWT.!
- 13. var header_data = {! alg: 'RSA', ! typ: 'JWT' ! };! Example JWT Header!
- 14. Difference between HMAC SHA256 and RSA SHA256 hashing algorithms! ! HMAC SHA256: Symmetric key cryptography, single shared private key. Faster, good between trusted parties.! ! RSA SHA256: Asymmetric key cryptography, public / private keys. Slower, good between untrusted parties.!
- 15. JWT Payload (Claims)! ! Reserved: Predefined, recommended, interoperable terms. ! ! Public: Customs claims that may be set at will.! ! Private: Agreed upon claims between two parties.!
- 16. Reserved Claims! ! iss (issuer): The person that issued the token.! sub (subject) : The subject of the token.! aud (audience) : Audience the token is intended for.! exp (expiration time) : Expiration time of the token.! nbf (not before) : Starting time token is available.! iat (issued at) : When the token was issued.! jti (JWT ID) : Unique identifier for the token. ! !
- 17. var payload = {! sub: '4355676',! exp: '1481160294',! jti: '841112',! role: 'admin'! };! Example JWT Payload!
- 18. JWT Signature! ! Encoded Data: Base64 encoded header + payload! ! Secret: A private key.!
- 19. var header = {! alg: 'RSA', ! typ: 'JWT' ! };! ! var payload = {! sub: '4355676',! exp: '1481160294',! jti: '841112’! };! ! HMACSHA256(! base64UrlEncode(header) + "." +! base64UrlEncode(payload),! secret)! Creating a JWT signature!
- 20. // generate private key! openssl genrsa -out private.pem 2048! ! // generate public key! openssl rsa -in private.pem -outform PEM -pubout -out public.pem! Creating new public / private keys (minus password for testing)!
- 21. var fs = require('fs'), ! ursa = require('ursa');! ! // set up public / private keys! var key = ursa.generatePrivateKey(), ! privatepem = key.toPrivatePem(),! publicpem = key.toPublicPem();! ! // store keys in .pem files ! try {! fs.writeFileSync('private.pem', privatepem, 'ascii');! fs.writeFileSync('public.pem', publicpem, 'ascii');! } catch (err) {! console.error(err);! }! Writing new public / private keys to the file system!
- 22. var jwt = require('jsonwebtoken'),! fs = require('fs');! ! // get private key! var cert = fs.readFileSync('private.pem');! ! // sign asynchronously with RSA SHA256 ! jwt.sign({ foo: 'bar' }, cert, { algorithm: 'RS256' }, function(err, token) {! console.log(token);! });! Signing JSON Web Tokens !
- 24. var jwt = require('jsonwebtoken'),! fs = require('fs');! ! //get public key ! cert = fs.readFileSync('public.pem'); ! ! // verify asynchronously with RSA SHA256! jwt.verify(token, cert, { algorithms: ['RS256'] }, function (err, payload) {! console.log(payload);! });! Verifying JSON Web Tokens!
- 25. Securing JWTs!
- 26. Securing JWTs! ! • Verify signature before trusting data in the JWT.! • Secure the secret key used for signing. Keys should only be accessible by the issuer and consumer.! • Do not add sensitive data to the JWT. They are signed to protect against manipulation, not encrypted.!
- 27. Preventing Replay Attacks! ! To prevent replay attacks, include the following claims to the JWT payload:! ! • jti (JWT ID): Random or pseudo-random nonce.! • exp (expiration): Time the token expires.! • iat (issued at): Time the token was issued. !
- 28. JSON Web Encryption (JWE) Specification! ! https://tools.ietf.org/html/rfc7516 !
- 29. Mixing JWTs with OAuth 2!
- 30. Benefits of the Specification! ! Existing Trust Relationships: If a site has an existing user relationship, that may be used.!
- 31. A Bit of History! ! OAuth, OpenID, authorization and authentication!
- 32. JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants! ! https://tools.ietf.org/pdf/rfc7523.pdf!
- 33. "JWT vs OAuth" is a comparison of apples and apple carts! ! JWT: Authentication protocol! OAuth: Distributed authorization framework !
- 34. User is forwarded to sign in, grant permissions Code is provided back in URI Request to exchange code for token How the OAuth 2 Process Generally Works Access Token is provided back
- 35. POST /token.oauth2 HTTP/1.1! Host: service.example.com! Content-Type: application/x-www-form-urlencoded! ! grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer! &assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6IjE2In0.! eyJpc3Mi[...omitted for brevity...].! J9l-ZhwP[...omitted for brevity...]! Authorization Example OAuth 2 access token request with JWT!
- 36. POST /token.oauth2 HTTP/1.1! Host: service.example.com! Content-Type: application/x-www-form-urlencoded! ! grant_type=authorization_code&! code=n0esc3NRze7LTCu7iYzS6a5acc3f0ogp4&! client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt- bearer! client_assertion=eyJhbGciOiJSUzI1NiIsImtpZCI6IjIyIn0.! eyJpc3Mi[...omitted for brevity...].! cC4hiUPo[...omitted for brevity...]! Authentication Example OAuth 2 access token request with JWT!
- 37. Validating the JWT! ! • iss (required): Unique issuer identity claim.! • sub (required): Identity the token subject! • Authorization: ID of a valid delegate. ! • Authentication: The OAuth 2 client ID.! • aud (required): Identity of the authorization server, such as the URI endpoint. !
- 38. Validating the JWT! ! • exp (required): Expiration to limit the time that the JWT can be used.! • nbf (optional): Time before which token must not be accepted.! • jti (optional): Uniquely identifies the token.! • other claims (optional): Any other claims may be present.!
- 39. Validating the JWT! ! • Digitally signed / Message Authentication Code: A valid signature / MAC must be present.! • Valid JWT: Must conform to the makeup of a JWT.!
- 40. Links and More Information! • Specifications: ! • JWT: https://tools.ietf.org/html/rfc7519! • JWT / OAuth2: https://tools.ietf.org/html/rfc7523! • JSON Web Encryption: https://tools.ietf.org/html/ rfc7516! • JWT Website: https://jwt.io/! • jsonwebtoken NPM module: https://www.npmjs.com/package/ jsonwebtoken!
- 41. Thank You!! Slides: slideshare.net/jcleblanc! Jonathan LeBlanc ! Twitter: @jcleblanc ! Book: http://bit.ly/iddatasecurity!