Using JSON Web Tokens for REST Authentication

By: Edward Chan

Using JSON Web Tokens for REST Authentication

Introduction

Edward Chan

@edwardchiapet

linkedin.com/in/edwardchan1350

drupal.org/u/edwardchiapet

Edward is an NYC-based Drupal Developer at Mediacurrent. He started working with Drupal in 2012 and has experience building Drupal sites in D6/7/8. He just recently became interested in decoupled architecture and has experience building and using Drupal as a backend service. He maintains the Quill and Autocomplete Deluxe modules.

Drupal Developer

2

github.com/edwardchan

About

3

Mediacurrent helps organizations build highly impactful, elegantly designed Drupal websites that achieve the strategic results they need.

● Single-source provider● Specializing in Drupal since 2007● Headquartered in Atlanta, GA● Team of 70+ Drupal Experts including

development, design and strategy● Clients include: Large Enterprise and

high-profile global brands

Style Guide

Agenda

Introduction to JSON Web Tokens (JWT)

Authenticating REST in Drupal

Comparing JWTs with other methods4

3

2

1

4

How It Works

#

JSON Web Tokens in Decoupled Architecture

5

● Separation of concerns● True statelessness● Flexibility


Introduction to JSON Web Tokens (JWT)1

What is JSON Web Token (JWT)?

7

“JSON Web Tokens are an open, industry standard RFC 7519 method that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA...”

- https://jwt.io/introduction


https://jwt.io/introduction


8

● Simply a string in the format of header.payload.signature ● A means of representing claims to be transferred between two parties.● Intended for space-constrained environments such as HTTP Authorization

headers and URI query parameters. ● Digitally-signed - information is verified and trusted.



9

● A JWT is a type of either JSON Web Signature (JWS) or JSON Web Encryption (JWE).

● The “claims” in a JWT are encoded as a JSON object that it is digitally-signed using JWS and/or encrypted using JWE.

● JWS is used in most cases.● The suggested/formal pronunciation of JWT is “jot”.


JSON Web Token Structure

10


JSON Web Token Structure

11


Header .Payload .Signature

JSON Web Token Structure - Header

12


● Contains information about how the JWT should be computed.● Typically contains:

○ “typ” - type of the token (“JWT”)○ “alg” - signing hashing algorithm being used to sign or encrypt the JWT - such as HMAC SHA256 or RSA

● Example:

JSON Web Token Structure - Payload

13


● Contains the “claims set”, which is information we want to transmit and other information about the token.● Types of claims:

○ Reserved - predefined claims that are recommended. ○ Public - claims that we create ourselves○ Private - custom claims that are usually more specific to the application you’re connecting to

● A list of predefined claims can be found in the IANA JSON Web Token Registry (https://www.iana.org/assignments/jwt/jwt.xhtml).

JSON Web Token Structure - Payload

14


exp Expiration time

iss Token issuer

iat Time the JWT was issued

nbf Not before

Some reserved claim names:

JSON Web Token Structure - Signature

15


● Used to verify that the sender of the JWT is legitimate and to ensure that the message was not changed or altered along the way.

● Value is generated by hashing the following using the signing algorithm specified in the “header”:○ base64UrlEncode(header) + “.” + base64UrlEncode(payload)○ a “secret” (held by the server and will be used to verify existing tokens and

sign new ones)

JSON Web Token Structure - Signature

16


Example of generating the signature using HMAC SHA256:

var encodedHeader = base64UrlEncode(header);var encodedPayload = base64UrlEncode(payload);var signature = base64UrlEncode(HMACSHA256(encodedHeader + “.” + encodedPayload, secret));

JSON Web Signature (JWS) Compact Serialization

17


Image source: “JWT” Handbook by Sebastián Peyrott

(encoded header)

(encoded payload)


18



(encoded header)

(encoded payload)


19




20



How It Works2

22

Authentication Process

How It Works

23


How It Works

24


How It Works

Bouncer with a guest list (server and a database)

25


How It Works

Yourself and your ID(username and password)

26


How It Works

Identity verified!(login credentials valid)

27


How It Works

Wristband (JWT)

28


How It Works

29


How It Works

Bar(Resource server)

30


How It Works

Consume API Resources

31


How It Works

JWT expires (“exp”)

32


Image source: https://jwt.io/introduction/

How It Works

33


How It Works

Image source: https://jwt.io/introduction/

How does JWT protect our data?

34


● Used to verify the authenticity of the source that sent the data. ● Short expiry times.● Retrieving a new JWT requires a valid refresh token. ● A signed JWT does not hide or obscure data in any way

Using JWTs to Authenticate REST in Drupal3

“JSON Web Token Authentication (JWT)” module

36

Using JWTs to Authenticate REST in Drupal

● https://www.drupal.org/project/jwt● Depends on the “Key” module to manage secret keys.● “JWT Authentication Issuer” - provides an endpoint to issue JWTs.● “JWT Authentication Consumer” - authenticates JWTs generated by “JWT Authentication Issuer”.● Provides 3 events for event subscribers:

○ VALIDATEAllows for custom validations for a JWT.

○ VALIDFires after a token has been validated. Subscribers can create new users based on the payload, if necessary.

○ GENERATEFires before a new JWT is encoded. Subscribers can add claims to the JWT before it is given to the client.

https://www.drupal.org/project/jwt

“JSON Web Token Authentication (JWT)” module

37


https://www.mediacurrent.com/blog/using-json-web-tokens-jwt-authenticate-endpoints

JWT Debugger

38


● Allows you to see the content of a JWT - including the claims in the payload.

● You can verify the validity of the token with a secret.

● Chrome extension!

Comparing JWTs with other methods4

Cookie-based Authentication

40

Comparing JWTs with other methods

JWT advantages

41


● Stateless● Scalability● Digitally-signed● Performance● CORS/CSRF● Mobile-ready● Decoupled/Decentralized

JWT drawbacks

42


● Size of token● Tokens Revocation● Single-Page Applications

@Mediacurrent Mediacurrent.com

Thank you!

slideshare.net/mediacurrent

https://jwt.io/https://www.drupal.org/project/jwt

https://www.mediacurrent.com/blog/using-json-web-tokens-jwt-authenticate-endpoints

https://twitter.com/mediacurrent

http://www.mediacurrent.com/

http://www.slideshare.net/mediacurrent

Using JSON Web Tokens for REST Authentication

Technology

Transcript of Using JSON Web Tokens for REST Authentication