Collaborate Disseminate
I am testing this application which sends JWT and CSRF token in cookies, I created a PoC file to test for CSRF, but only CSRF token is being sent in the PoC request and not JWT.
I was under the impression that cookies are always sent in al… Continue reading JWT is being sent in cookies, but when I try for CSRF they are not sent
I am struggling to implement JWT refresh tokens with the Double Submit Cookies method.
My current set up for a browser based webapp without refresh tokens looks like this:
Upon successful login, API server returns JWT with expiry in a ht… Continue reading JWT refresh tokens and Double Submit Cookies
I develop an Angular app with a NodeJS API.
I am trying to add security to my application and so I need to create a safe authentication. To do it I have found some courses to add JWT to requests and especially followed this one. I have the… Continue reading Create safe authentication in Angular app with NodeJS API [closed]
I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that.
Flow is as below.
When authenticated successfully,
Generate accessToken as JWT also a… Continue reading JWT implementation and protection against CSRF and XSS
I want to make an application that uses oauth2 and JWT as access tokens for securing some apis and providing authentication mechanisms. The application is a microservice architecture and wirtten in python. It would be deployed on AWS. So I… Continue reading Is creating asymmetric keys dynamically and storing in memory safe?
Wrapping my head around JWE and the key management modes.
The point of JWE is to prevent third parties to see/change the token. Only the token issuer and resource server should be able to use it. (Is this correct?)
To encrypt the token’s p… Continue reading JWE and the key management modes
I have read a few articles regarding JWT refresh tokens, and how/why they are used. One thing i have seen mentioned here: https://hasura.io/blog/best-practices-of-using-jwt-with-graphql/#persistance and here: https://dev.to/cotter/localsto… Continue reading Why does using JWT refresh tokens protect against CSRF during authentication?
Consider the following set up applications and services:
apps:
mycompany.com webapp
apis:
products api
orders api
mycompany.com’s webapp uses OAuth2/openidconnect with an IdP (such as auth0) to authenticate a user, and a JWT token … Continue reading client security separate from user context
I have been reading a lot about where you should store your JWT tokens for web applications. Local storage and cookies has its pros and cons.
So I thought that maybe it could be a good idea to instead create 4 tokens? 2 access tokens and 2… Continue reading Security idea for storing JWT tokens, is this a good idea?
I am trying to implement JWT in a secure way in Node.js and I am unsure when to request the refresh token.
I got one access token and one refresh token. Both are saved in two httpOnly cookies. When the access token expires the refresh toke… Continue reading When to request refresh token? JWT