0

I have implemented the JWT based authentication system for one of out API usage requirement. Which means, if user want to access any REST Api, then will communicate API using JWT token. This is how the steps should follow:

  1. User will call the /Authenticate method passing username/ password.
  2. System will validate the user and return the JWT token and Timeout in a response.
  3. Now, user will call /Employee/Get API method along with the JWT token in the request header. E.g. Authorization: Bearer {token}
  4. Things are working quite well.

Now the question is, once the token is generated, any user can grab the token by capturing the network request/ by any tool which can read the request/ response in Network system.

Which means that, if I have generated the JWT token for user Mark, then by grabbing the same toke, some other user can pass the same token in the header, and can access my /Employee/Get API method.

Now, the token will be validated because it was generated from the same system and system doesn't know about the user, it just know the JWT token.

How would I ensure that the other user cannot use the same token OR even if they pass same token, my system should reject the request. How would I make it secure?

Thanks in advance!

Damian T
  • 53
  • 1
  • 3
  • 8

1 Answers1

0

Posession of JWT is the proof-of-authentication. If a token is stolen then the attacker can impersonate user. So you need to protect it:

Community
  • 1
  • 1
pedrofb
  • 37,271
  • 5
  • 94
  • 142
  • Even though it is stored in localStorage OR cookie, it must needs to be passed on every sub-subsequent request. right? So anyone by tempering the request get the token, then they can also access further API calls by passing same token in Authorization header... So how would I restrict that OR make it secure?? – Damian T Mar 01 '17 at 14:20
  • Yes, it is needed to send the token in each request, usually in the Authorization header. You need to set a SSL/TLS channel (https), then all data sent between client and server will be encrypted and nobody will be able to obtain the token sniffing network traffic – pedrofb Mar 01 '17 at 14:33