First Draft for JWT Best Practices Doc #1182

chalbersma · 2023-08-11T21:25:16Z

Ignores .idea files (pycharm ide)
Index updated by make generate-site
Added assets/JWTCSA as a place for assets and snippets
Added a JWT Cheat Sheet Doc
Fixed google_analytics in mkdocs.yaml
Added pymdownx plugins for:
- Admonitions (blocks.details)
- Code Snippets (snippets)
- Tabbed Content (tabbed)
Pinned modern minimum versions on requirements.txt

This PR covers issue #1176 .

Please do not merge yet. This is a work in progress at best.

* Ignores .idea files (pycharm ide) * Index updated by make generate-site * Added assets/JWTCSA as a place for assets and snippets * Added a JWT Cheat Sheet Doc * Fixed google_analytics in mkdocs.yaml * Added pymdownx plugins for: * Admonitions (`blocks.details`) * Code Snippets (`snippets`) * Tabbed Content (`tabbed`) * Pinned modern minimum versions on requirements.txt

chalbersma · 2023-08-11T21:26:08Z

How the multi language stuff ends up looking.

szh · 2023-08-30T13:46:17Z

Please do not merge yet. This is a work in progress at best

I marked this PR as a draft so nobody does by mistake.

jmanico · 2023-09-07T16:19:43Z

I am super eager to see this fleshed out, can I help? Wanna meet and discuss?

chalbersma · 2023-09-08T05:55:46Z

Honestly we probably should, but I'm super busy this week. I might have some time next.

* Still not ready * Taking some feedback from our attempt to implement a jwt based auth scheme professionally. * Recommends jwt symmetrically signed with jwks certificates as it seems like it will be the best supported and offers an upgrade/portability path to OIDC.

chalbersma · 2023-10-28T07:05:22Z

Slow going but was able to get a little more work on this. Have a JWKS + JWT example in python in there atm.

EbonyAdder · 2023-11-25T15:25:57Z

Hello, @chalbersma , just wanted to check where things stand on this or if you would like any assistance? I am familiar with JWT security and multiple programming languages, so I would be happy to assist if it wanted.

chalbersma · 2023-11-29T16:41:23Z

Hello @EbonyAdder

At the company I work for we were looking to adopt a JWT auth-based standard. I was going to use the lessons learned and example code from that to populate this best practices document. Unfortunately in the process of building, I think we're learning an unfortunate less for "naked" jwts authentication/authorization; that it might be best to use a "fuller" service mesh style system (think envoy) to manage these tokens and connections.

This is still on my to-do list; I've just lost confidence that the approach recommended is still what should be recommended at this time.

jmanico · 2024-04-13T20:14:19Z

Can we revisit this? Here are some of the ASVS requirements for ASVS 5.0.

V3.5 Token-based Session Management

Token-based session management includes JWT, OAuth, SAML, and API keys. Of these, API keys are known to be weak and should not be used in new code. JWTs and SAML tokens are examples of stateless session tokens. All checks noted below should be enforced by a trusted, back-end service as noted above.

#	Description	L1	L2	L3	CWE	NIST §
3.5.1	[GRAMMAR] Verify that the application allows users to revoke OAuth tokens that form trust relationships with linked applications.		✓	✓	290	7.1.2
3.5.2	[MOVED TO 3.1.3]
3.5.3	[MODIFIED, LEVEL L2 > L1] Verify that stateless session tokens make use of a digital signature to protect against tampering and this is checked before processing it further.	✓	✓	✓	345
3.5.4	[ADDED] Verify that stateless tokens are checked for expiration before processing them further.	✓	✓	✓	613
3.5.5	[ADDED] Verify that only allow-listed signing algorithms are allowed for a stateless token.	✓	✓	✓	757
3.5.6	[ADDED] Verify that other, security-sensitive attributes of a stateless token are being verified. For example, in a JWT this may include issuer, subject, and audience.	✓	✓	✓	287
3.5.7	[ADDED] Verify that all active stateless tokens, which are being relied upon for access control decisions, are revoked when admins change the entitlements or roles of the user.	✓	✓	✓	613

randomstuff · 2024-05-21T08:53:47Z

cheatsheets/JWT_Cheat_Sheet.md

+
+## Issues
+
+### None Hashing Algorithm


None is not an "hashing" algorithm. It is an "authentication algorithm".

randomstuff · 2024-10-08T20:06:51Z

assets/JWTCSA/0-verification.md

+<!-- --8<-- [start:pyjwt] -->
+```
+try:
+    pyjwt.decode(encoded, key, algorithms=["HS256","ES256"])


This is weird to support HS256 (a MAC) and ES256 (a signature) at the same time. Either your key is a shared secret and you will support HS256 or this is a public key and you support ES256. I think ES256 is spurious here. This would be consistent with other examples.

randomstuff · 2024-10-08T20:10:20Z

assets/JWTCSA/1-jwks.md

+import uuid
+from jwcrypto import jwk, jwt
+
+unique_kid = uuid.uuid4()


I'm always wondering why everyone keep insisting on using UUID for this kind of things when you can just use a random token :) What about unique_kid = secrets.token_urlsafe(20)? It is shorter than a uuid.uuid4() but still has more entropy.

randomstuff · 2024-10-08T20:16:05Z

assets/JWTCSA/1-jwks.md

+
+# Publish to Datastore in Multinode system
+
+this_token = jwt.JWT(header={"alg": "RS256"},


This is a JWT but at the same time there is not expiration. There should probably at least be some expiration in the "default example"?

randomstuff · 2024-10-08T20:23:11Z

cheatsheets/JWT_Cheat_Sheet.md

+
+## Introduction
+
+Many applications use **JSON Web Tokens** (JWT) to allow the client to indicate its identity for further exchange after


"to allow the client", I guess you mean the user. JWT can definitely be used to represent claims about the client, I think you are actually thinking more about the user.

randomstuff · 2024-10-08T20:30:12Z

cheatsheets/JWT_Cheat_Sheet.md

+#### Symptom
+
+This attack occurs when a token has been intercepted/stolen by an attacker and they use it to gain access to the system
+ using targeted user identity. In part, this attack really can't be mitigated "in platform" as JWTs are generically stateless


It could be mitigated using some proof-of-possession such as:

sender-constrained JWT such as TLS-bound access tokens and DPoP access tokens;

SD-JWT bound to a public key pair

randomstuff · 2024-10-08T20:31:52Z

cheatsheets/JWT_Cheat_Sheet.md

+
+#### Symptom
+
+This problem is inherent to JWT because a token only becomes invalid when it expires. The


Should we reference the OAuth status List draft for revocation-list based approach?

chalbersma requested review from mackowski, jmanico and szh as code owners August 11, 2023 21:25

Fixes markdown linting errors.

c2e3e28

szh marked this pull request as draft August 30, 2023 13:45

chalbersma and others added 2 commits October 27, 2023 22:01

Merge branch 'master' into jwt_things

6aa2eea

More work on this

4dcaedf

* Still not ready * Taking some feedback from our attempt to implement a jwt based auth scheme professionally. * Recommends jwt symmetrically signed with jwks certificates as it seems like it will be the best supported and offers an upgrade/portability path to OIDC.

Updating Cheat Sheet

cc26767

randomstuff reviewed May 21, 2024

View reviewed changes

randomstuff reviewed Oct 8, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

First Draft for JWT Best Practices Doc #1182

First Draft for JWT Best Practices Doc #1182

chalbersma commented Aug 11, 2023

chalbersma commented Aug 11, 2023

szh commented Aug 30, 2023

jmanico commented Sep 7, 2023

chalbersma commented Sep 8, 2023

chalbersma commented Oct 28, 2023

EbonyAdder commented Nov 25, 2023

chalbersma commented Nov 29, 2023

jmanico commented Apr 13, 2024 •

edited

Loading

randomstuff May 21, 2024

randomstuff Oct 8, 2024 •

edited

Loading

randomstuff Oct 8, 2024 •

edited

Loading

randomstuff Oct 8, 2024

randomstuff Oct 8, 2024

randomstuff Oct 8, 2024

randomstuff Oct 8, 2024


		# Publish to Datastore in Multinode system

		this_token = jwt.JWT(header={"alg": "RS256"},


		## Introduction

		Many applications use JSON Web Tokens (JWT) to allow the client to indicate its identity for further exchange after


		#### Symptom

		This problem is inherent to JWT because a token only becomes invalid when it expires. The

First Draft for JWT Best Practices Doc #1182

Are you sure you want to change the base?

First Draft for JWT Best Practices Doc #1182

Conversation

chalbersma commented Aug 11, 2023

chalbersma commented Aug 11, 2023

szh commented Aug 30, 2023

jmanico commented Sep 7, 2023

chalbersma commented Sep 8, 2023

chalbersma commented Oct 28, 2023

EbonyAdder commented Nov 25, 2023

chalbersma commented Nov 29, 2023

jmanico commented Apr 13, 2024 • edited Loading

V3.5 Token-based Session Management

randomstuff May 21, 2024

Choose a reason for hiding this comment

randomstuff Oct 8, 2024 • edited Loading

Choose a reason for hiding this comment

randomstuff Oct 8, 2024 • edited Loading

Choose a reason for hiding this comment

randomstuff Oct 8, 2024

Choose a reason for hiding this comment

randomstuff Oct 8, 2024

Choose a reason for hiding this comment

randomstuff Oct 8, 2024

Choose a reason for hiding this comment

randomstuff Oct 8, 2024

Choose a reason for hiding this comment

jmanico commented Apr 13, 2024 •

edited

Loading

randomstuff Oct 8, 2024 •

edited

Loading

randomstuff Oct 8, 2024 •

edited

Loading