Slides from Micah Silverman's, Stormpath Developer Evangelist, webinar on using JWTs to protect against CSRF as well as to secure communications between microservices. Micah shows how JWTs can be used to secure web applications built with Java and protect from 'unsafe' clients.

2. •
•
•
•
•

3. •
•
•
•

4. User Data
User
Workflows Google ID
Your Applications
Application SDK
Application SDK
Application SDK
ID Integrations
Facebook
Active
Directory
SAML

6. encodeSecret =
"4pE8z3PBoHjnV1AhvGk+e8h2p+ShZpOnpr8cwHmMh1w="
computeHMACSHA256(
header + "." + payload,
base64DecodeToByteArray(encodedSecret)
)
Signature Computation Pseudo-code

8. .signWith(
SignatureAlgorithm.HS256,
"secret".getBytes("UTF-8")
)
Short but not Sweet

9. String b64EncodedSecret =
"Yn2kjibddFAWtnPJ2AFlL8WXmohJMCvigQggaEypa5E=";
.signWith(
SignatureAlgorithm.HS256,
b64EncodedSecret.getBytes("UTF-8")
)
You’re Doing it Wrong

10. String b64EncodedSecret =
"Yn2kjibddFAWtnPJ2AFlL8WXmohJMCvigQggaEypa5E=";
.signWith(
SignatureAlgorithm.HS512,
TextCodec.BASE64.decode(b64EncodedSecret)
)
Supersize that Secret!

12. AuthenticationService
AuthorizationService
ApplicationService
OrganizationService
DirectoryService
AccountService
GroupService
Database
Infrastructure

13. Database
Infrastructure
GroupServiceAccountService
AuthenticationService AuthorizationService
ApplicationService
OrganizationService
DirectoryService

14. ●
○
○
●
●
●
●
●
●
○
●