jwt-rest.md

REST Authentication with JWT

---

🇦🇷 Nacho Anaya

@ianaya89

• Full Stack Developer, Tech Trainer & Speaker
• Ambassador @Auth0
• Organizer @Vuenos_Aires

---

^ I will use the help of thinking face

---

🤔 Why token authentication?

---

🤔 Why token authentication?

> Stateless

^ 1. The server does not have to keep a record ^ 2. No server session

---

🤔 Why token authentication?

> Decoupled

^ 1. Token could be issued for other server. ^ 2. Perfect for cross domain (no cookies)

---

🤔 Why token authentication?

> Scalable

^ 1. Reduce data look up ^ horizontally scale ^ No client session

---

🤔 Why JWT?

---

🤔 Why JWT?

> Standard RFC 7519

^ 1. Base on web standard RFC 7519 ^ Defines A safe way to represent a set of information between two parties

---

🤔 Why JWT?

> Self Contained

^ 2. All the info is inside (transmit information)

---

🤔 Why JWT?

> Compact

^ 3. NO XML, lighter content

---

🤔 Why JWT?

> Signed

HMAC - RSA - ECDSA

^ 4. Cryptographic Signed ^ Keeps token secure ^ Allows to validate against modifications ^ Hashed message or public/private key pairs

---

🤔 Why JWT?

> JSON 🙌

^ 5. Easy to read and parse, humans and machines

---

🤔 What is JWT?

^ Token based on encoded JSON

---

🤔 What is JWT?

header.payload.signature

+ Base64

^ Is composed by tree base64 Parts, separated by dots

---

🤔 What is JWT?

---

💆 Header

{
  "alg": "HS256",
  "typ": "JWT"
}

^ type & algoritm, In this cases hashed message

---

👌 Payload

{
  "id": "1234567890",
  "name": "John Doe",
  "admin": true,
  "iss": "https://api.com",
  "exp": 1510745797148
}

^ claims, information to exchange public claims

---

👌 Payload

{
  "id": "1234567890",
  "name": "John Doe",
  "admin": true,
  "iss": "https://api.com",
  "exp": 1510745797148
}

^ reserved claims

---

✍️ Signature

const data = base64urlEncode( header ) + '.' +
  base64urlEncode( payload )

HMACSHA256(data, 'your_secret_message')

^ encoded header & payload + secret (encrypted) ^ proves identity ^ ensure message can't change

---

✍️ Signature

const data = base64urlEncode( header ) + '.' +
  base64urlEncode( payload )

HMACSHA256(data, 'your_secret_message')

---

---

🤔 When to use it?

---

🤔 When to use it?

> Authentication

> Information Exchange

---

🤔 Where to use it?

---

🤔 Where to use it?

SPA's - Mobile

Serverless - IoT

^ AI OU TI

---

---

🥁

^ drums sound

---

👏 REST API's

---

🤔 How does it work with REST?

---

---

🤔 How does it work with REST?

1. Sends Credentials

POST /login

{
	"user": "ianaya89",
	"password": "dont-hack-me"
}

---

🤔 How does it work with REST?

2. Creates JWT

const jwt = require('jsonwebtoken')

// POST /login
function login (req, res, next) {
  // Validates user credentials...

  const payload = { user: 'ianaya89', role: 'admin' }

  const token = jwt.sign(payload, 'this_is_super_secret')
  res.status(201).send({ token: `Bearer ${token}` })
}

router.post('/login', login)

---

🤔 How does it work with REST?

3. Returns JWT

const jwt = require('jsonwebtoken')

// POST /login
function login (req, res, next) {
  // Validates user credentials...

  const payload = { user: 'ianaya89', role: 'admin' }

  const token = jwt.sign(payload, 'this_is_super_secret')
  res.status(201).send({ token: `Bearer ${token}` })
}

router.post('/login', login)

^ The client should save / persist the token

---

🤔 How does it work with REST?

4. Gets a resource

GET /resource
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkiLCJuYW1lIjoiSm9obiBEb2UiLCJhZG1pbiI6ZmFsc2V9.
b99O1RrYbHtWJ3MGZXkdADZkmiLm9HNliRccKxMPDuc

^ Access protected endpoint, The client should save / persist the token

---

🤔 How does it work with REST?

5. Verifies token

const jwt = require('jsonwebtoken')

// GET /resource
function getResource (req, res, next) {
  try {
    const payload = jwt.verify(token, 'this_is_super_secret')
  }
  catch (err) {
     return res.sendStatus(401)
  }
}

router.get('/resource', getResource)

^ middleware, automatization

---

🤔 How does it work with REST?

6. Sends response

const jwt = require('jsonwebtoken')

// GET /resource
function getResource (req, res, next) {
  try {
    const payload = jwt.verify(token, 'this_is_super_secret')
    res.send('👌')
  }
  catch (err) {
     return res.sendStatus(401)
  }
}

router.get('/resource', getResource)

---

🤔 How does it work with REST?

6. Sends response

const jwt = require('jsonwebtoken')

// GET /resource
function getResource (req, res, next) {
  try {
    const payload = jwt.verify(token, 'this_is_super_secret')

    if (payload.role !== 'admin') {
      return res.sendStatus(403)
    }

    res.send('👌')
  }
  catch (err) {
     return res.sendStatus(401)
  }
}

router.get('/resource', getResource)

---

🤔 Which languages are supported?

---

🤔 Which languages are supported?

> "All" of them

Libraries

---

🤔 Is JWT secure?

---

🥁

^ drums sound

---

🤔 Is JWT secure?

👌 Yes

---

🤔 Is JWT secure?

🤭 But...

^ there is always a but

---

^ Forest's mom said

---

🤔 Is JWT secure?

> Anyone can view the content

^ Don't store sensitive information

---

🤔 Is JWT secure?

> No one can modify it

---

🤔 Is JWT secure?

> JWT is signed not ecnrpyted

^ JSON Web Encryption allows you to safely encrypt the claims of a token

---

🤔 Is JWT secure?

> Keep your "secret" secret 😏

---

📚 Resources

• jwt.io
• jwt-handbook
• demo-auth-jwt-api

---

👕

---

👏 Thanks!

@ianaya89

bit.ly/rest-auth-jwt