Using JSON Web Tokens for REST Authentication

By: Edward Chan
Using JSON Web Tokens
for REST Authentication

Introduction
Edward Chan
@edwardchiapet
linkedin.com/in/edwardchan1350
drupal.org/u/edwardchiapet
Edward is an NYC-based Drupal Developer at Mediacurrent. He
started working with Drupal in 2012 and has experience building
Drupal sites in D6/7/8. He just recently became interested in
decoupled architecture and has experience building and using Drupal
as a backend service. He maintains the Quill and Autocomplete Deluxe
modules.
Drupal Developer
2
github.com/edwardchan

About
3
Mediacurrent helps organizations build highly
impactful, elegantly designed Drupal websites that
achieve the strategic results they need.
● Single-source provider
● Specializing in Drupal since 2007
● Headquartered in Atlanta, GA
● Team of 70+ Drupal Experts including
development, design and strategy
● Clients include: Large Enterprise and
high-profile global brands

Style Guide
Agenda
Introduction to JSON Web Tokens (JWT)
Authenticating REST in Drupal
Comparing JWTs with other methods4
3
2
1
4
How It Works

JSON Web Tokens in Decoupled Architecture
5
● Separation of concerns
● True statelessness
● Flexibility

Introduction to JSON Web Tokens (JWT)1

What is JSON Web Token (JWT)?
7
“JSON Web Tokens are an open, industry standard RFC 7519 method that defines a
compact and self-contained way for securely transmitting information between parties
as a JSON object. This information can be verified and trusted because it is digitally
signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private
key pair using RSA...”
- https://jwt.io/introduction

8
● Simply a string in the format of header.payload.signature
● A means of representing claims to be transferred between two parties.
● Intended for space-constrained environments such as HTTP Authorization
headers and URI query parameters.
● Digitally-signed - information is verified and trusted.

9
● A JWT is a type of either JSON Web Signature (JWS) or JSON Web Encryption
(JWE).
● The “claims” in a JWT are encoded as a JSON object that it is digitally-signed using
JWS and/or encrypted using JWE.
● JWS is used in most cases.
● The suggested/formal pronunciation of JWT is “jot”.

JSON Web Token Structure
10

JSON Web Token Structure
11
Header .
Payload .
Signature

JSON Web Token Structure - Header
12
● Contains information about how the JWT should be computed.
● Typically contains:
○ “typ” - type of the token (“JWT”)
○ “alg” - signing hashing algorithm being used to sign or encrypt the JWT - such as HMAC SHA256 or RSA
● Example:

JSON Web Token Structure - Payload
13
● Contains the “claims set”, which is information we want to transmit and other information about the token.
● Types of claims:
○ Reserved - predefined claims that are recommended.
○ Public - claims that we create ourselves
○ Private - custom claims that are usually more specific to the application you’re connecting to
● A list of predefined claims can be found in the IANA JSON Web Token Registry
(https://www.iana.org/assignments/jwt/jwt.xhtml).

JSON Web Token Structure - Payload
14
exp Expiration time
iss Token issuer
iat Time the JWT was issued
nbf Not before
Some reserved claim names:

JSON Web Token Structure - Signature
15
● Used to verify that the sender of the JWT is legitimate and to ensure that the
message was not changed or altered along the way.
● Value is generated by hashing the following using the signing algorithm specified in
the “header”:
○ base64UrlEncode(header) + “.” + base64UrlEncode(payload)
○ a “secret” (held by the server and will be used to verify existing tokens and
sign new ones)

JSON Web Token Structure - Signature
16
Example of generating the signature using HMAC SHA256:
var encodedHeader = base64UrlEncode(header);
var encodedPayload = base64UrlEncode(payload);
var signature = base64UrlEncode(HMACSHA256(encodedHeader + “.”
+ encodedPayload, secret));

JSON Web Signature (JWS) Compact Serialization
17
Image source: “JWT” Handbook by Sebastián Peyrott
(encoded header)
(encoded payload)

18
(encoded header)
(encoded payload)

19

20

22
Authentication Process
How It Works

23
How It Works

24
How It Works
Bouncer with a guest list
(server and a database)

25
How It Works
Yourself and your ID
(username and password)

26
How It Works
Identity verified!
(login credentials valid)

27
How It Works
Wristband
(JWT)

28
How It Works

29
How It Works
Bar
(Resource server)

30
How It Works
Consume API
Resources

31
How It Works
JWT expires (“exp”)

32
Image source: https://jwt.io/introduction/
How It Works

33
How It Works
Image source: https://jwt.io/introduction/

How does JWT protect our data?
34
● Used to verify the authenticity of the source that sent the data.
● Short expiry times.
● Retrieving a new JWT requires a valid refresh token.
● A signed JWT does not hide or obscure data in any way

Using JWTs to Authenticate REST in Drupal3

“JSON Web Token Authentication (JWT)” module
36
Using JWTs to Authenticate REST in Drupal
● https://www.drupal.org/project/jwt
● Depends on the “Key” module to manage secret keys.
● “JWT Authentication Issuer” - provides an endpoint to issue JWTs.
● “JWT Authentication Consumer” - authenticates JWTs generated by “JWT Authentication Issuer”.
● Provides 3 events for event subscribers:
○ VALIDATE
Allows for custom validations for a JWT.
○ VALID
Fires after a token has been validated. Subscribers can create new users based on the payload, if necessary.
○ GENERATE
Fires before a new JWT is encoded. Subscribers can add claims to the JWT before it is given to the client.

“JSON Web Token Authentication (JWT)” module
37
https://www.mediacurrent.com/blog/using-json-web-tokens-jwt-authenticate-endpoints

JWT Debugger
38
● Allows you to see the content of a JWT -
including the claims in the payload.
● You can verify the validity of the token with a
secret.
● Chrome extension!

Comparing JWTs with other methods4

Cookie-based Authentication
40
Comparing JWTs with other methods

JWT advantages
41
● Stateless
● Scalability
● Digitally-signed
● Performance
● CORS/CSRF
● Mobile-ready
● Decoupled/Decentralized

JWT drawbacks
42
● Size of token
● Tokens Revocation
● Single-Page Applications

@Mediacurrent Mediacurrent.com
Thank you!
slideshare.net/mediacurrent
https://jwt.io/
https://www.drupal.org/project/jwt
https://www.mediacurrent.com/blog/using-json-web-tokens-jwt-authenticate-endpoints

Using JSON Web Tokens for REST Authentication

More Related Content

What's hot (20)

Similar to Using JSON Web Tokens for REST Authentication (20)

More from Mediacurrent (20)

Recently uploaded (20)

Using JSON Web Tokens for REST Authentication