I need to manage jwt secret keys individually for each user?

Question

I implemented jwt authentication using the jsonwebtoken module. But do I need to create and manage arbitrary secret keys for each user when generating and verifying jwt tokens? Is there a difference between managing secret keys separately for each user and generating and verifying jwt tokens with one secret key?

score 5 · Answer 1 · 2017-09-08T12:51:35.597

5

No, you use a single secret key to sign your tokens. This is because when the token comes back to you in a request, you need to be able to decode the token, and at this point you don’t know whether a genuine user is sending your token, because you haven’t verified it yet.

Use a single key to sign and verify your tokens, and remember to keep it safe.

edited Sep 08 '17 at 12:51

answered Sep 08 '17 at 09:01

4

Technically nothing stops you from parsing the header and/or the payload of a JWT token _before_ checking the signature. However the token cannot be trusted at this stage. – cassiomolin Sep 08 '17 at 12:49
Thank you so much!! Rothschild, Cassio Mazzochi Molin – HungryBird Sep 10 '17 at 04:33

score 4 · Answer 2 · edited Oct 07 '21 at 11:07

4

No, you definitely don't need a key per user. A single key is enough for all users in most of situations.

If you want to, you can have a set of different keys and rotate them periodically to sign the tokens. In this situation, use the kid header claim to hold a key identifier and then use it to look up the right key to verify the token. See more details in this answer.

edited Oct 07 '21 at 11:07

Community

1
1

answered Sep 08 '17 at 11:23

cassiomolin

124,154
35
280
359

Thank you so much!! Cassiio Mazzochi Molin – HungryBird Sep 10 '17 at 04:33

James · Answer 3 · 2017-09-08T11:01:15.653

Is there a difference between managing secret keys separately for each user and generating and verifying jwt tokens with one secret key?

The short answer is no, as far as a JWT is concerned a key is a key.

The long answer is it depends. The purpose of the JWT secret is to ensure the integrity of the message, generally this is something you would do at issuer (server) level as a way of verifying the origin of the message. In layman's terms, if the server can verify the signature then it can trust the contents.

User-level secrets move the trust down a level in the sense that you don't care which server generated the message but rather which user did. In a typical authentication token scenario it's really more server trust you want.

I need to manage jwt secret keys individually for each user?

3 Answers3