State of JSON Web Tokens at Employment Hero

1. JSON Web Tokens
Luong Vo

8. JSON Web Token

9. What is JSON Web Tokens

10. JSON Object
To transfer data
between two parties
digitally signed

11. Digitally signed
JSON Data Signature JSON Web Token

12. Signature signing algorithm

13. RSA256

14. HSA256

15. Comparison
RSA256 HSA256

18. JSON API
Authentication

19. Main app
Username +
password
Session token
Auth Service
Generate session token
Save
session
token
to
database
But why?

20. Main app
Session token
JWT Token
Auth Service
Generate JWT
Query session token
to check
But why?

21. Main app
Get/….
+ JWT Token
{ “data”: …. }
Auth Service
Validate JWT
But why?

22. Main app
Get/….
+ JWT Token
{ “data”: …. }
Auth Service
Validate JWT
Microservice
GRPCcall
But why?

23. Microservice
API Call !?
Oh….

24. Main app
Get/….
+ JWT Token
{ “data”: …. }
Auth Service
Validate
JW
T
Microservice
Oh….

25. External system
Main app
Microservice

27. Microservice
API Call
Should we?
Auth Service
authenticate

28. Microservice
API Call
Better!
LOAD BALANCER
Auth Service
authenticate
API Gateway

29. Main app
Get/….
+ JWT Token
{ “data”: …. }
Auth Service Microservice
LOAD BALANCER

33. https://github.com/Thinkei/eh-kong/blob/master/auth/handler.lua#L49

35. Why not just use JWT

36. Size
User ID in JWT
User id in session token

37. ● Require CPU to compute cryptographic signatures
● No utilisation of being stateless
● Redundant-signing
● Can be read on the client side
● Must be explicitly encrypted if we wanted to
● Hard revocation

38. That’s it. Thank you
for your attention!