SlideShare a Scribd company logo
1 of 128
Download to read offline
WTH IS A JWT
IT’S NOT PRONOUNCED ‘JOT’
WTH IS A JWT
IT’S NOT PRONOUNCED ‘JOT’
@joel__lord #AllThingsOpen
WTH IS A JWT
ABOUT ME
@joel__lord
joellord
@joel__lord #AllThingsOpen
WTH IS A JWT
SPA BEST PRACTICES
@joel__lord #AllThingsOpen
WTH IS A JWT
SPA BEST PRACTICES
▸ …
@joel__lord
joellord
All Things Open, Raleigh, NC
October 23th, 2018
THANK YOU
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
https://myserver.com
@joel__lord #AllThingsOpen
https://myserver.com
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
🔗
@joel__lord #AllThingsOpen
https://myserver.com User
🔗
⛔
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://api.myserver.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
❓
JSON WEB
TOKENS
INTRODUCING
@joel__lord #AllThingsOpen
WTH IS A JWT
JSON WEB TOKENS
▸ JWT's (RFC 7519) are an open
industry standard  method for
representing claims securely
between two parties.
@joel__lord #AllThingsOpen
WTH IS A JWT
JSON WEB TOKENS
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp
XVCJ9.eyJzdWIiOjEsInNjb3BlIjoiY
XBpOnJlYWQiLCJ1c2VybmFtZSI6I
mpvZWxsb3JkIiwiaXNzIjoibXktc21
hbGwtYXV0aC1zZXJ2ZXIiLCJhdW
QiOiJteS1yYW5kb20tY2xpY2tiYW
l0LWFwaSIsImlhdCI6MTUzNzg5M
TQyOCwiZXhwIjoxNTM3ODkyMDI
4fQ.gEY3pRSdrnK5VtJI6E9vgada
OQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
A SIMPLE ANALOGY
▸ How is a Drivers License like a JSON Web Token?
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp
XVCJ9.eyJzdWIiOjEsInNjb3BlIjoiY
XBpOnJlYWQiLCJ1c2VybmFtZSI6I
mpvZWxsb3JkIiwiaXNzIjoibXktc21
hbGwtYXV0aC1zZXJ2ZXIiLCJhdW
QiOiJteS1yYW5kb20tY2xpY2tiYW
l0LWFwaSIsImlhdCI6MTUzNzg5M
TQyOCwiZXhwIjoxNTM3ODkyMDI
4fQ.gEY3pRSdrnK5VtJI6E9vgada
OQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
A SIMPLE ANALOGY
▸ How is a Drivers License like a JSON Web Token?
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp
XVCJ9.eyJzdWIiOjEsInNjb3BlIjoiY
XBpOnJlYWQiLCJ1c2VybmFtZSI6I
mpvZWxsb3JkIiwiaXNzIjoibXktc21
hbGwtYXV0aC1zZXJ2ZXIiLCJhdW
QiOiJteS1yYW5kb20tY2xpY2tiYW
l0LWFwaSIsImlhdCI6MTUzNzg5M
TQyOCwiZXhwIjoxNTM3ODkyMDI
4fQ.gEY3pRSdrnK5VtJI6E9vgada
OQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
▸ Drivers Licence
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
▸ Drivers Licence
▸ Province of Quebec
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
▸ eyJhbGciOiJIUzI1NiIsInR5c
CI6IkpXVCJ9
▸ Drivers Licence
▸ Province of Quebec
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
▸ atob(“eyJhbGciOiJIUzI1NiI
sInR5cCI6IkpXVCJ9”);
▸ Drivers Licence
▸ Province of Quebec
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
{
"alg": "HS256",
"typ": "JWT"
}
▸ Drivers Licence
▸ Province of Quebec
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
▸ Picture
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
▸ Picture
▸ Name
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
▸ Picture
▸ Name
▸ Date of Birth
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
▸ Picture
▸ Name
▸ Date of Birth
▸ Restrictions
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
eyJzdWIiOjEsInNjb3BlIjoiYXBpOnJlYWQiL
CJ1c2VybmFtZSI6ImpvZWxsb3JkIiwiaXNzI
joibXktc21hbGwtYXV0aC1zZXJ2ZXIiLCJhd
WQiOiJteS1yYW5kb20tY2xpY2tiYWl0LWF
waSIsImlhdCI6MTUzNzg5MTQyOCwiZXhw
IjoxNTM3ODkyMDI4fQ
▸ Picture
▸ Name
▸ Date of Birth
▸ Restrictions
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
atob(“eyJzdWIiOjEsInNjb3BlIjoiYXBpOnJlY
WQiLCJ1c2VybmFtZSI6ImpvZWxsb3JkIiwi
aXNzIjoibXktc21hbGwtYXV0aC1zZXJ2ZXIi
LCJhdWQiOiJteS1yYW5kb20tY2xpY2tiYW
l0LWFwaSIsImlhdCI6MTUzNzg5MTQyOCw
iZXhwIjoxNTM3ODkyMDI4fQ”);
▸ Picture
▸ Name
▸ Date of Birth
▸ Restrictions
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
{
"sub": 1,
"scope": "api:read",
"username": "joellord",
"iss": "my-small-auth-server",
"aud": "my-random-clickbait-api",
"iat": 1537891428,
"exp": 1537892028
}
▸ Picture
▸ Name
▸ Date of Birth
▸ Restrictions
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
▸ Holograms
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
▸ Holograms
▸ Signature
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
gEY3pRSdrnK5VtJI6E9vgada
OQuLNWILBvvGasR4CRk
▸ Holograms
▸ Signature
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
HMACSHA256(
`${header}.${payload}`,
“mysupersecret”
);
▸ Holograms
▸ Signature
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
HMACSHA256(
`${header}.${payload}`,
“mysupersecret”
);
▸ Holograms
▸ Signature
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
HMACSHA256(
`${header}.${payload}`,
“mysupersecret”
);
▸ Holograms
▸ Signature
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
📝
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
📝
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
📝
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
📝
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
📝
👍
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
💰
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
💰
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
💰
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
💰
✋
DEMO
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
/api/cats
🔗
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
/api/book
🔗
✋
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
/api/cats
🔗
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
https://api.myserver.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com https://login.myserver.com
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
/authorize
@joel__lord #AllThingsOpen
/authorize
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
/api/cats
@joel__lord #AllThingsOpen
/api/cats
@joel__lord #AllThingsOpen
/api/cats
@joel__lord #AllThingsOpen
WTH IS A JWT
SENDING THE TOKEN TO THE API
▸ Using Axios
@joel__lord #AllThingsOpen
WTH IS A JWT
SENDING THE TOKEN TO THE API
▸ Using Fetch
@joel__lord #AllThingsOpen
WTH IS A JWT
SENDING THE TOKEN TO THE API
@joel__lord #AllThingsOpen
❓
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
/authorize
@joel__lord #AllThingsOpen
/authorize
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
🔄
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
▸ You can never completely secure your front-end using
JWTs
▸ You can “hide” some routes
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
)
@joel__lord #AllThingsOpen
WTH IS A JWT
RESOURCES
▸ General JWT resource
▸ jwt.io
@joel__lord #AllThingsOpen
WTH IS A JWT
RESOURCES
▸ General JWT resource
▸ jwt.io
▸ Overview of JWT Signing Algorithms
▸ bit.ly/jwt-alg
@joel__lord #AllThingsOpen
WTH IS A JWT
RESOURCES
▸ General JWT resource
▸ jwt.io
▸ Overview of JWT Signing Algorithms
▸ bit.ly/jwt-alg
▸ JWT Handbook
▸ bit.ly/jwt-book
@joel__lord #AllThingsOpen
WTH IS A JWT
SUMMARY
▸ Single Page Application security is mainly concerned
with authorization. 
@joel__lord #AllThingsOpen
WTH IS A JWT
SUMMARY
▸ Single Page Application security is mainly concerned
with authorization. 
▸ JSON Web Tokens are excellent for securing SPA
applications.
@joel__lord #AllThingsOpen
WTH IS A JWT
SUMMARY
▸ Single Page Application security is mainly concerned
with authorization. 
▸ JSON Web Tokens are excellent for securing SPA
applications.
▸ Many excellent JWT Libraries exist for all languages and
frameworks.
@joel__lord
joellord
All Things Open, Raleigh, NC
October 23rd, 2018
THANK YOU
TEXT
TEXT

More Related Content

More from Joel Lord

Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine LearningJoel Lord
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)Joel Lord
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)Joel Lord
 
WTH is a JWT
WTH is a JWTWTH is a JWT
WTH is a JWTJoel Lord
 
Asynchonicity: concurrency. A tale of
Asynchonicity: concurrency. A tale ofAsynchonicity: concurrency. A tale of
Asynchonicity: concurrency. A tale ofJoel Lord
 
I Don't Care About Security
I Don't Care About Security I Don't Care About Security
I Don't Care About Security Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)Joel Lord
 
Secure your SPA with Auth0
Secure your SPA with Auth0Secure your SPA with Auth0
Secure your SPA with Auth0Joel Lord
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine LearningJoel Lord
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine LearningJoel Lord
 
Rise of the Nodebots
Rise of the NodebotsRise of the Nodebots
Rise of the NodebotsJoel Lord
 
Let's Get Physical
Let's Get PhysicalLet's Get Physical
Let's Get PhysicalJoel Lord
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine LearningJoel Lord
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine LearningJoel Lord
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine LearningJoel Lord
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine LearningJoel Lord
 
Apprendre l'apprentissage automatisé
Apprendre l'apprentissage automatiséApprendre l'apprentissage automatisé
Apprendre l'apprentissage automatiséJoel Lord
 

More from Joel Lord (20)

Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
WTH is a JWT
WTH is a JWTWTH is a JWT
WTH is a JWT
 
Asynchonicity: concurrency. A tale of
Asynchonicity: concurrency. A tale ofAsynchonicity: concurrency. A tale of
Asynchonicity: concurrency. A tale of
 
I Don't Care About Security
I Don't Care About Security I Don't Care About Security
I Don't Care About Security
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
Secure your SPA with Auth0
Secure your SPA with Auth0Secure your SPA with Auth0
Secure your SPA with Auth0
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Rise of the Nodebots
Rise of the NodebotsRise of the Nodebots
Rise of the Nodebots
 
Let's Get Physical
Let's Get PhysicalLet's Get Physical
Let's Get Physical
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Apprendre l'apprentissage automatisé
Apprendre l'apprentissage automatiséApprendre l'apprentissage automatisé
Apprendre l'apprentissage automatisé
 

Recently uploaded

Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Delivery
Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on DeliveryCall Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Delivery
Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Deliverybabeytanya
 
VIP Kolkata Call Girl Dum Dum 👉 8250192130 Available With Room
VIP Kolkata Call Girl Dum Dum 👉 8250192130  Available With RoomVIP Kolkata Call Girl Dum Dum 👉 8250192130  Available With Room
VIP Kolkata Call Girl Dum Dum 👉 8250192130 Available With Roomdivyansh0kumar0
 
VIP Kolkata Call Girl Alambazar 👉 8250192130 Available With Room
VIP Kolkata Call Girl Alambazar 👉 8250192130  Available With RoomVIP Kolkata Call Girl Alambazar 👉 8250192130  Available With Room
VIP Kolkata Call Girl Alambazar 👉 8250192130 Available With Roomdivyansh0kumar0
 
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012rehmti665
 
Delhi Call Girls Rohini 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls Rohini 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip CallDelhi Call Girls Rohini 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls Rohini 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Callshivangimorya083
 
GDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark Web
GDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark WebGDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark Web
GDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark WebJames Anderson
 
Gram Darshan PPT cyber rural in villages of india
Gram Darshan PPT cyber rural  in villages of indiaGram Darshan PPT cyber rural  in villages of india
Gram Darshan PPT cyber rural in villages of indiaimessage0108
 
Russian Call Girls Thane Swara 8617697112 Independent Escort Service Thane
Russian Call Girls Thane Swara 8617697112 Independent Escort Service ThaneRussian Call Girls Thane Swara 8617697112 Independent Escort Service Thane
Russian Call Girls Thane Swara 8617697112 Independent Escort Service ThaneCall girls in Ahmedabad High profile
 
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)Dana Luther
 
VIP Kolkata Call Girl Kestopur 👉 8250192130 Available With Room
VIP Kolkata Call Girl Kestopur 👉 8250192130  Available With RoomVIP Kolkata Call Girl Kestopur 👉 8250192130  Available With Room
VIP Kolkata Call Girl Kestopur 👉 8250192130 Available With Roomdivyansh0kumar0
 
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts serviceChennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts servicesonalikaur4
 
Call Girls Dubai Prolapsed O525547819 Call Girls In Dubai Princes$
Call Girls Dubai Prolapsed O525547819 Call Girls In Dubai Princes$Call Girls Dubai Prolapsed O525547819 Call Girls In Dubai Princes$
Call Girls Dubai Prolapsed O525547819 Call Girls In Dubai Princes$kojalkojal131
 
VIP Call Girls Kolkata Ananya 🤌 8250192130 🚀 Vip Call Girls Kolkata
VIP Call Girls Kolkata Ananya 🤌  8250192130 🚀 Vip Call Girls KolkataVIP Call Girls Kolkata Ananya 🤌  8250192130 🚀 Vip Call Girls Kolkata
VIP Call Girls Kolkata Ananya 🤌 8250192130 🚀 Vip Call Girls Kolkataanamikaraghav4
 
Radiant Call girls in Dubai O56338O268 Dubai Call girls
Radiant Call girls in Dubai O56338O268 Dubai Call girlsRadiant Call girls in Dubai O56338O268 Dubai Call girls
Radiant Call girls in Dubai O56338O268 Dubai Call girlsstephieert
 
Low Rate Young Call Girls in Sector 63 Mamura Noida ✔️☆9289244007✔️☆ Female E...
Low Rate Young Call Girls in Sector 63 Mamura Noida ✔️☆9289244007✔️☆ Female E...Low Rate Young Call Girls in Sector 63 Mamura Noida ✔️☆9289244007✔️☆ Female E...
Low Rate Young Call Girls in Sector 63 Mamura Noida ✔️☆9289244007✔️☆ Female E...SofiyaSharma5
 
VIP Kolkata Call Girls Salt Lake 8250192130 Available With Room
VIP Kolkata Call Girls Salt Lake 8250192130 Available With RoomVIP Kolkata Call Girls Salt Lake 8250192130 Available With Room
VIP Kolkata Call Girls Salt Lake 8250192130 Available With Roomgirls4nights
 

Recently uploaded (20)

Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Delivery
Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on DeliveryCall Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Delivery
Call Girls In Mumbai Central Mumbai ❤️ 9920874524 👈 Cash on Delivery
 
Model Call Girl in Jamuna Vihar Delhi reach out to us at 🔝9953056974🔝
Model Call Girl in  Jamuna Vihar Delhi reach out to us at 🔝9953056974🔝Model Call Girl in  Jamuna Vihar Delhi reach out to us at 🔝9953056974🔝
Model Call Girl in Jamuna Vihar Delhi reach out to us at 🔝9953056974🔝
 
VIP Kolkata Call Girl Dum Dum 👉 8250192130 Available With Room
VIP Kolkata Call Girl Dum Dum 👉 8250192130  Available With RoomVIP Kolkata Call Girl Dum Dum 👉 8250192130  Available With Room
VIP Kolkata Call Girl Dum Dum 👉 8250192130 Available With Room
 
VIP Kolkata Call Girl Alambazar 👉 8250192130 Available With Room
VIP Kolkata Call Girl Alambazar 👉 8250192130  Available With RoomVIP Kolkata Call Girl Alambazar 👉 8250192130  Available With Room
VIP Kolkata Call Girl Alambazar 👉 8250192130 Available With Room
 
Dwarka Sector 26 Call Girls | Delhi | 9999965857 🫦 Vanshika Verma More Our Se...
Dwarka Sector 26 Call Girls | Delhi | 9999965857 🫦 Vanshika Verma More Our Se...Dwarka Sector 26 Call Girls | Delhi | 9999965857 🫦 Vanshika Verma More Our Se...
Dwarka Sector 26 Call Girls | Delhi | 9999965857 🫦 Vanshika Verma More Our Se...
 
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
Call Girls South Delhi Delhi reach out to us at ☎ 9711199012
 
Delhi Call Girls Rohini 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls Rohini 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip CallDelhi Call Girls Rohini 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls Rohini 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
 
GDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark Web
GDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark WebGDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark Web
GDG Cloud Southlake 32: Kyle Hettinger: Demystifying the Dark Web
 
Gram Darshan PPT cyber rural in villages of india
Gram Darshan PPT cyber rural  in villages of indiaGram Darshan PPT cyber rural  in villages of india
Gram Darshan PPT cyber rural in villages of india
 
Russian Call Girls Thane Swara 8617697112 Independent Escort Service Thane
Russian Call Girls Thane Swara 8617697112 Independent Escort Service ThaneRussian Call Girls Thane Swara 8617697112 Independent Escort Service Thane
Russian Call Girls Thane Swara 8617697112 Independent Escort Service Thane
 
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)
Packaging the Monolith - PHP Tek 2024 (Breaking it down one bite at a time)
 
VIP Kolkata Call Girl Kestopur 👉 8250192130 Available With Room
VIP Kolkata Call Girl Kestopur 👉 8250192130  Available With RoomVIP Kolkata Call Girl Kestopur 👉 8250192130  Available With Room
VIP Kolkata Call Girl Kestopur 👉 8250192130 Available With Room
 
Rohini Sector 6 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
Rohini Sector 6 Call Girls Delhi 9999965857 @Sabina Saikh No AdvanceRohini Sector 6 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
Rohini Sector 6 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
 
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts serviceChennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service
Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service
 
Call Girls Dubai Prolapsed O525547819 Call Girls In Dubai Princes$
Call Girls Dubai Prolapsed O525547819 Call Girls In Dubai Princes$Call Girls Dubai Prolapsed O525547819 Call Girls In Dubai Princes$
Call Girls Dubai Prolapsed O525547819 Call Girls In Dubai Princes$
 
VIP Call Girls Kolkata Ananya 🤌 8250192130 🚀 Vip Call Girls Kolkata
VIP Call Girls Kolkata Ananya 🤌  8250192130 🚀 Vip Call Girls KolkataVIP Call Girls Kolkata Ananya 🤌  8250192130 🚀 Vip Call Girls Kolkata
VIP Call Girls Kolkata Ananya 🤌 8250192130 🚀 Vip Call Girls Kolkata
 
Rohini Sector 26 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
Rohini Sector 26 Call Girls Delhi 9999965857 @Sabina Saikh No AdvanceRohini Sector 26 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
Rohini Sector 26 Call Girls Delhi 9999965857 @Sabina Saikh No Advance
 
Radiant Call girls in Dubai O56338O268 Dubai Call girls
Radiant Call girls in Dubai O56338O268 Dubai Call girlsRadiant Call girls in Dubai O56338O268 Dubai Call girls
Radiant Call girls in Dubai O56338O268 Dubai Call girls
 
Low Rate Young Call Girls in Sector 63 Mamura Noida ✔️☆9289244007✔️☆ Female E...
Low Rate Young Call Girls in Sector 63 Mamura Noida ✔️☆9289244007✔️☆ Female E...Low Rate Young Call Girls in Sector 63 Mamura Noida ✔️☆9289244007✔️☆ Female E...
Low Rate Young Call Girls in Sector 63 Mamura Noida ✔️☆9289244007✔️☆ Female E...
 
VIP Kolkata Call Girls Salt Lake 8250192130 Available With Room
VIP Kolkata Call Girls Salt Lake 8250192130 Available With RoomVIP Kolkata Call Girls Salt Lake 8250192130 Available With Room
VIP Kolkata Call Girls Salt Lake 8250192130 Available With Room
 

What is a JWT - JSON Web Token explained