5 ms·
Once I worked on a team that none of the engineers knew that jwt payload was readable on the frontend. They were in shock when I extracted the payload and start
by gusbremm 4y ago
Once I worked on a team that none of the engineers knew that jwt payload was readable on the frontend. They were in shock when I extracted the payload and started asking questions about the data structure.
- samhw 4y agoI mean, I'd be rather surprised too. What were you using JWTs for, if not asymmetric crypto? Presumably you weren't using it to sign the tokens, if they were surprised the client could access them? And I can't see many contexts where you would use it with a shared secret, where just sending JSON over HTTPS wouldn't suffice. (I'm assuming 'frontend' here denotes a client on the other side of the trust boundary.)
- FlorianRappl 4y agoI'm not getting your comment. The payload is not encrypted. I think you refer to the signature. The payload can always be decoded. It's just JSON into base64.
- samhw 4y agoAh, sorry, that was what I was referring to when I said "Presumably you weren't using it to sign the tokens, if they were surprised the client could access them?". I classed that as too obvious for it to be what you meant.
- chrisandchris 4y agoFor SSO? The biggest advantage (besides being stateless) about a JWT is that it is signed with an asymetric key and the client can validate the authenticity of the content. You can encrypt the content of the token, but that does not make to much sense (because the client anyway needs to decrypt it).
- lmc 4y agoIt's kinda baffling that JWTs are unencrypted by default, to be fair.
- bornfreddy 4y agoHow else could frontend read them? If you don't need this then regular cookies are better.
- lmc 4y agoIt's the other way round - the front-end shouldn't need to read JWTs, just pass them on.
- mosdave 4y agoif your frontend is interrogating the jwt you're doing it wrong
- nijave 4y agoIsn't it pretty common to read the expiration so you know when to refresh tokens?
- bornfreddy 4y agoIt is, among other things like username or user e-mail address. This is also, together with backend scalability, a major selling point for JWTs. Otherwise one might just as well use regular session ids in cookies.
- bpicolo 4y agoIt's the whole point - they're signed, not encrypted. You should use opaque tokens instead if you don't want the frontend or other services that have access to the token to read it.
- lmc 4y agoIn many cases, the front end doesn't need to read the JWT, just pass it on to some API. An encrypted JWT is still convenient as it can be decrypted and deserialized into a common data structure using existing libraries.