2

is it possible to encrypt keycloak access token using public key and decrypt the payload using private key ? Because, If someone got the keycloak access token he can easily see the token content at https://jwt.io/ since it can be decrypted with public key.

can we make JWT token more secure using keycloak ?

jmd_dk
  • 12,125
  • 9
  • 63
  • 94
Amol Jadhav
  • 133
  • 2
  • 6
  • Access tokens are meant to be decryptable to see their content, but not modifiable, since they are signed. A user shouldn't share his access tokens with anybody. Also, the access tokens are supposed to contain only info related to their own user. So there's no issue of them being readable ;-) – Aritz Apr 13 '20 at 17:12
  • Thank you @XtremeBiker, I agree with your answer. I know access tokens are base64 encoded and encoded != encryption. So my question was is it possible to encrypt the token with public key ? Just curious.. – Amol Jadhav Apr 14 '20 at 15:09
  • You might find [this](https://stackoverflow.com/a/46784443/1199132) useful. – Aritz Apr 14 '20 at 15:50

1 Answers1

0

According to the JWT website's introduction (https://jwt.io/introduction) - yes, the JWT token can be encrypted to provide secrecy between parties.

What is JSON Web Token?
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

Although JWTs can be encrypted to also provide secrecy between parties, we will focus on signed tokens. Signed tokens can verify the integrity of the claims contained within it, while encrypted tokens hide those claims from other parties. When tokens are signed using public/private key pairs, the signature also certifies that only the party holding the private key is the one that signed it.

You will need to consult your provider's documentation like AppId, Keycloak, Azure B2C, etc for more information on how to encrypt it if it is supported by your auth provider.

Peter Poliwoda
  • 563
  • 2
  • 7
  • 19