Question about authentication by #JWT: 1- My client get loggin and

Question

Question about authentication by #JWT: 1- My client get loggin and

I generate a token for him/her and store the token in localstorage. No If somebody else copy this token from locanstorage of this person browser and paset in his/her (I mean hacker) browser local storage, this hacker will be logged in? If yes soe is that safe?

2- I put user Id in the token that I generated On login function. On each reuest that is sending to backend I shuld check the JWT token. I should decode token and find userId in it. Now I should I compar this user id by anything? Example checking that is there any session by this user ID in backend or even checking the user Id by DB?

3- should I put an expirattion time for jwt token on local store?

#english #programming

0

15.10.2018

3 ответов

7 просмотров

visualcontext

2. You can embed user ID in jwt token. When the handler recieves request, You can try decrypting the jwt token. If the decryption succeeds, You know the token was generated with your credentials and is legit otherwise you can return a 400 response.

0

15.10.2018

visualcontext

yes that's your preference but I suggest setting an expiration date of 7-15 days.

0

15.10.2018

visualcontext · Accepted Answer

1. A program's security model can not encompass every possible scenario. To copy jwt tokens from created by some website, You'll need, 1. Physical Access to device or 2. exploit some sort of vulnerability on the website that'll allow arbitrary js script execution. If someone gets physical access to a device then most security models fail so there is nothing you can do about it. Https will prevent second scenario from happening.

169 похожих чатов

Question about authentication by #JWT: 1- My client get loggin and

3 ответов

Похожие вопросы