Collaborate Disseminate
This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error.
403 error means that the request was unauthorized.
I know th… Continue reading What happens first in a request having both CSRF Token and JWT token, authentication or authorization?
I am implementing a web service with a front end and back end. Everything but the login endpoint requires authentication. For authentication I use Authentik. However, I have trouble wrapping my head around which tokens to give to the user,… Continue reading OIDC + Authentik: Which token to give to user for authentication?
First of all, I know that passwords generally do not have to be stored in a JWT or JWS since the token in itself can be used to authenticate. My circumstances are very specific though.
In my program, I need to startup a process as the user… Continue reading Is it bad practice to store passwords in a JWE? If so, why?
I’ve been reading about how clients can verify JWT signatures using a public key provided by the server. I’m struggling to understand how this solves any issues.
The only attack I’ve seen which this claims to solve is when a reverse proxy … Continue reading How is client side JWT signature validation beneficial from a security perspective?
Where to store JWT refresh tokens? My idea was to encrypt the refresh token with crypto-js AES and salt, keeping it in an environment variable (.env). Then, the refresh token would be stored in either local storage or cookies. I am still d… Continue reading Where to store JWT refresh tokens
I’m working on the authentication part of my application.
Previously, I was using Firebase but I decided to work differently for some reason.
As I never implemented such a system, I’m asking for your expertise.
The user click on "Log… Continue reading Is there a security flaw in this authentication Flow?
I have two use-cases I am trying to solve.
A HTTP Service-A hosted on XYZ domain tries to access HTTP Service-B on ABC domain. Service-B is a stateless HTTP API which does not have user concept. Service-A maintains user information. Task … Continue reading Passing user identity to a different REST service
In other words, is a signature on a JWT or JWS always unique?
Continue reading Could the signature of a JWT/JWS be used as a globally unique identifier?
Prerequisites
I have a client application (CA), an authentication server (AS) and a resource server (RS).
The resources on the RS must be accessed and usable only by authenticated users which have the authorization to do so.
The AS and RS … Continue reading Will a verified JWT token always ensure that user is authenticated when signed by an authentication server?
I’m creating a backend that supports authentication with JWT tokens. I’m using the classic access token / refresh token combo.
the access token is valid for 5 minutes and allows the users to perform some actions. It’s not checked against … Continue reading Strong reason to not send refresh token on every request?