7 ms·

Discord puts the authentication token in local storage

by hackermondev 9mo ago

edoceo 9mo ago
Is that a problem on its own? It's like, encrypted right? Maybe a time sensitive token?
- seangrogg 9mo ago
  Depends on the token; JWTs usually have payloads that are only base64 encoded. As well, if there's a refresh token in there it can be used to generate more tokens until invalidated (assuming invalidation is built in).
- socketcluster 9mo ago
  Not a problem in itself. Also, there's not much point of encrypting tokens. The attacker could use the encrypted token to authenticate themselves without having to decrypt. They could just make a request from the victim's own browser. They could do this with cookies too even with httpOnly cookies. XSS is a big problem. If a hacker can inject a script into your front end and make it execute, it's game over. Once they get to that point, there's an infinite number of things they can do. They basically own the user's account.
  - arethuza 9mo ago
    Does anyone actually encrypt the contents of JWTs? I'd have thought that anyone who has concerns about the contents of the token being easily visible would be likely to avoid JWTs anyway and just use completely opaque tokens?
    - kbolino 9mo ago
      Encrypted tokens are opaque but they are also offline-verifiable. A simple opaque token has to be verified online (typically, against a database) whenever it's used. Auth0, for example, supports JWE for its access tokens: https://auth0.com/docs/secure/tokens/access-tokens/json-web-encryption https://auth0.com/docs/secure/tokens/access-tokens/json-web-...
    - socketcluster 9mo ago
      JWT supports some encryption algorithms as an alternative to signatures but my experience is that most people like to keep it simple. JWT is intended for authentication. Most of the time you're basically just signing a token containing an account ID and nothing else... Sometimes a list of groups but that only scales to a small number of groups.

Discord puts the authentication token in local storage

edoceo 9mo ago

Is that a problem on its own? It's like, encrypted right? Maybe a time sensitive token?

seangrogg 9mo ago
Depends on the token; JWTs usually have payloads that are only base64 encoded. As well, if there's a refresh token in there it can be used to generate more tokens until invalidated (assuming invalidation is built in).
socketcluster 9mo ago
Not a problem in itself. Also, there's not much point of encrypting tokens. The attacker could use the encrypted token to authenticate themselves without having to decrypt. They could just make a request from the victim's own browser. They could do this with cookies too even with httpOnly cookies. XSS is a big problem. If a hacker can inject a script into your front end and make it execute, it's game over. Once they get to that point, there's an infinite number of things they can do. They basically own the user's account.
- arethuza 9mo ago
  Does anyone actually encrypt the contents of JWTs? I'd have thought that anyone who has concerns about the contents of the token being easily visible would be likely to avoid JWTs anyway and just use completely opaque tokens?
  - kbolino 9mo ago
    Encrypted tokens are opaque but they are also offline-verifiable. A simple opaque token has to be verified online (typically, against a database) whenever it's used. Auth0, for example, supports JWE for its access tokens: https://auth0.com/docs/secure/tokens/access-tokens/json-web-encryption https://auth0.com/docs/secure/tokens/access-tokens/json-web-...
  - socketcluster 9mo ago
    JWT supports some encryption algorithms as an alternative to signatures but my experience is that most people like to keep it simple. JWT is intended for authentication. Most of the time you're basically just signing a token containing an account ID and nothing else... Sometimes a list of groups but that only scales to a small number of groups.