JSON Web Token (JWT) Cheat Sheet for Java - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T13:48:12Z

Point to the official site

Thunder-Son: Migration to GitHub

2019-02-14T12:58:50Z

Migration to GitHub

Show changes

Ron Perris at 17:55, 20 April 2018

2018-04-20T17:55:46Z

Peter Mosmans: Fix typo

2018-03-22T08:44:44Z

Fix typo

Peter Mosmans: Fix typo

2018-03-22T07:06:55Z

Fix typo

Dominique RIGHETTO: Implements feedback from Paul Ionescu

2017-12-09T10:34:46Z

Implements feedback from Paul Ionescu

Show changes

Dominique RIGHETTO: Replace PRE tag by Syntax highliting tag

2017-11-24T20:28:19Z

Replace PRE tag by Syntax highliting tag

Show changes

Dominique RIGHETTO: Take in account feedback from Paul Ionescu, refactor the fingerprint approach, add section about weak secret, add section about token revocation, add section about consideration using jwt

2017-11-19T08:56:48Z

Take in account feedback from Paul Ionescu, refactor the fingerprint approach, add section about weak secret, add section about token revocation, add section about consideration using jwt

Show changes

Jmanico at 06:07, 11 September 2017

2017-09-11T06:07:49Z

Dominique RIGHETTO: Add token structure example

2017-02-17T20:31:48Z

Add token structure example

← Older revision		Revision as of 13:48, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.md JSON Web Token (JWT) Cheat Sheet for Java] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html JSON Web Token (JWT) Cheat Sheet for Java] to see the latest version of the cheat sheet.

@@ Line 51: / Line 51: @@
 = Objective =
-This article have for objective to provide several tips in a form of a cheatsheet, for Java technology, in order to prevent common security issues meet when using JWT.
+The tips presented in this article are part of a Java project that was created to show the correct way to handle creation and validation of JSON Web Tokens. You can find the Java project [https://github.com/righettod/poc-jwt here], it uses the official [https://jwt.io/#libraries JWT library].
 In the rest of the article, the term '''token''' refer to the '''JSON Web Tokens''' (JWT).

@@ Line 62: / Line 62: @@
 = Consideration about using JWT =
-Even if a JWT token is "easy" to use and allow to expose services (mostly REST style) in a stateless way, it's not the solution that fits for all applications because it cames with some caveats like for example the question of the storage of the token (tackled in this cheatsheet) and others...
+Even if a JWT token is "easy" to use and allow to expose services (mostly REST style) in a stateless way, it's not the solution that fits for all applications because it comes with some caveats, like for example the question of the storage of the token (tackled in this cheatsheet) and others...
-If your application do not need to be fully stateless, you can consider using traditional session system provided by all web frameworks and follow the advices from the dedicated [[Session_Management_Cheat_Sheet|cheatsheet]]. However, for stateless applications, when well implemented, it's a good candidate.
+If your application does not need to be fully stateless, you can consider using traditional session system provided by all web frameworks and follow the advice from the dedicated [[Session_Management_Cheat_Sheet|cheatsheet]]. However, for stateless applications, when well implemented, it's a good candidate.
 = Issues =

@@ Line 8: / Line 8: @@
 __TOC__{{TOC hidden}}
-Many applications use '''JSON Web Tokens''' (JWT) to allow the client to indicate is identity for further exchange after authentication.
+Many applications use '''JSON Web Tokens''' (JWT) to allow the client to indicate its identity for further exchange after authentication.
 From ''https://jwt.io/introduction'':

@@ Line 1: / Line 1: @@
-Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
+ __NOTOC__
 = Introduction  =
 Many application use '''JSON Web Tokens''' (JWT) to allow the client to indicate is identity for further exchange after authentication.
@@ Line 601: / Line 606: @@
 [[User:Dominique_RIGHETTO|Dominique Righetto]] - dominique.righetto@owasp.org
 = Other Cheatsheets =
 {{Cheatsheet_Navigation_Body}}
 [[Category:Cheatsheets]]

← Older revision		Revision as of 20:31, 17 February 2017
Line 10:		Line 10:

	JSON Web Token is used to carry information related to the identity and characteristics (claims) of a client. This "container" is signed by the server in order to avoid that a client tamper it in order to change, for example, the identity or any characteristics (example: change the role from simple user to admin or change the client login). This token is created during authentication (is provided in case of successful authentication) and is verified by the server before any processing. It is used by an application to allow a client to present a token representing his "identity card" (container with all user information about him) to server and allow the server to verify the validity and integrity of the token in a secure way, all of this in a stateless and portable approach (portable in the way that client and server technologies can be different including also the transport channel even if HTTP is the most often used).		JSON Web Token is used to carry information related to the identity and characteristics (claims) of a client. This "container" is signed by the server in order to avoid that a client tamper it in order to change, for example, the identity or any characteristics (example: change the role from simple user to admin or change the client login). This token is created during authentication (is provided in case of successful authentication) and is verified by the server before any processing. It is used by an application to allow a client to present a token representing his "identity card" (container with all user information about him) to server and allow the server to verify the validity and integrity of the token in a secure way, all of this in a stateless and portable approach (portable in the way that client and server technologies can be different including also the transport channel even if HTTP is the most often used).
		+
		+	= Token structure =
		+
		+	Token structure example taken from ''https://jwt.io/#debugger'':
		+
		+	'''[ Base64(HEADER) ] . [ Base64(PAYLOAD) ] . [ Base64(SIGNATURE) ]'''
		+
		+	<pre>
		+	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ
		+	</pre>
		+
		+	Chunk 1: Header
		+	<pre>
		+	{
		+	"alg": "HS256",
		+	"typ": "JWT"
		+	}
		+	</pre>
		+
		+	Chunk 2: Payload
		+	<pre>
		+	{
		+	"sub": "1234567890",
		+	"name": "John Doe",
		+	"admin": true
		+	}
		+	</pre>
		+
		+	Chunk 3: Signature
		+	<pre>
		+	HMACSHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload), KEY )
		+	</pre>

	= Objective =		= Objective =