"Json Web Token with digital signature. Modern authentication or authorization. Cookies are bad. Avoid Man-in-the-middle-attack. No need to protect against CSRF. Stateless.

1. JSONWEBTOKEN
DeddySetyadi

2. Itshipsinformation
thatcanbeverified
andtrusted
withadigitalsignature
JWT?

3. http://searchsecurity.techtarget.com/definition/digital-signature

4. Stateless
JWTallowtheservertoverifythe
informationcontainedintheJWT
withoutnecessarilystoringstate
ontheserver.
http://secure.indas.on.ca

5. http://www.slideshare.net/liuggio/json-web-token-api-authorizatio
n

6. NONEEDPROTECTAGAINSTCSRF
https://www.incapsula.com/web-application-security/csrf-cross-site-request-forgery.html

7. AVOIDMan-in-the-middle
https://blog.digicert.com/thwarting-man-middle/

8. JSONWEBTOKEN
https://scotch.io/tutorials/the-anatomy-of-a-json-web-token

9. Header
{
"typ": "JWT",
"alg": "HS256"
}
PARTSOFTheheader:
● declaringthetype,which
isJWT
● thehashingalgorithmto
use

10. CommonJWTSigningAlgorithms
HS256 HMAC using SHA-256
RS256 RSASSA-PKCS1-v1_5 using SHA-256
ES256 ECDSA using P-256 and SHA-256
https://tools.ietf.org/html/rfc7518#section-3

11. Payload
Carrytheinformationthatwe
wanttotransmit,alsocalled
theJWTClaims.
{
"iss": "scotch.io",
"exp": 1300819380,
"name": "Chris Sevilleja",
"admin": true
}

12. ReSERVEDClaims
iss
Theissuerofthetoken.
sub
Thesubjectofthetoken.
aud
Theaudienceofthetoken.
exp
Thiswilldefinetheexpiration.
nbf
thetimebeforewhichtheJWTMUST
NOTbeaccepted.
iat
ThetimetheJWTwasissued.
jti
UniqueidentifierfortheJWT.
https://tools.ietf.org/html/rfc7518#section-3

13. Signature
Madeupofahashofthe
followingcomponents:
● theheader
● thepayload
● secret
var encodedString =
base64UrlEncode(header) + "." +
base64UrlEncode(payload);
HMACSHA256(encodedString,'secret');

14. FullJSONofJWT
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJpc3MiOiJzY290Y2guaW8iLCJleHAiOjEz
MDA4MTkzODAsIm5hbWUiOiJDaHJpcyB
TZXZpbGxlamEiLCJhZG1pbiI6dHJ1ZX0.
03f329983b86f7d9a9f5fef85305880101d5e302
afafa20154d094b229f757
HEADER
CLAIMS
SIGNATURE

15. References
● http://www.slideshare.net/liuggio/json-web-token-api-a
uthorization
● https://scotch.io/tutorials/the-anatomy-of-a-json-web-t
oken
● https://auth0.com/blog/json-web-token-signing-algorit
hms-overview/
● http://jwt.io
● https://blog.digicert.com/thwarting-man-middle/
● https://www.incapsula.com/web-application-security/cs
rf-cross-site-request-forgery.html