Tag: JWT
-
Bridging two ecosystems rather than forking one
LexikJWTAuthenticationBundle handles authentication. JWT-Framework handles JOSE. A bridge is a hundred lines; a fork would have been a second project to maintain.
-
Rotating signing keys without breaking anyone
Key rotation is four steps and one waiting period. Skipping the waiting period is what turns a routine operation into an incident.
-
Signed, encrypted, or both? Choosing what a JWT should be
A signed token proves who wrote it. An encrypted token hides what it says. They answer different questions, and the answer is not always “both”.
-
Understanding JSON Web Tokens: verifying properly
A valid signature is the first check, not the last. The claims that must be verified, the ones people forget, and the order to do it in.
-
Understanding JSON Web Tokens: choosing an algorithm
RFC 7518 lists dozens of algorithms. In practice the choice comes down to three questions, and a couple of names you should stop using.
-
Understanding JSON Web Tokens: the keys, with JWK
A key format that travels as JSON, key sets you can publish, thumbprints that identify a key by its content, and rotation without downtime.
-
Understanding JSON Web Tokens: encrypting with JWE
Encryption hides the payload from everyone but its recipient. Five parts instead of three, two keys instead of one, and a vocabulary worth learning once.
-
Understanding JSON Web Tokens: signing with JWS
A signature turns two JSON objects into something a recipient can trust. How JWS works, what the three parts of a compact token are, and why the header is protected.
-
Understanding JSON Web Tokens: structure
What a JWT actually is, why the format exists, which standards describe it, and what its two JSON objects contain.
-
AEAD without the tag: a ChaCha20-Poly1305 story
The authentication tag was computed, then dropped. What remained looked like an AEAD and authenticated nothing. GHSA-6vvh-pxr4-25r7.
-
One number, one denial of service: PBES2 and p2c
A password-based algorithm lets the token say how many iterations to run. Nothing said it had to be a reasonable number. GHSA-3prj-6hqw-cm82.
-
A padding oracle in RSA1_5, and what constant-time rejection means
Distinguishing a bad padding from a good one is enough to decrypt without the key. Bleichenbacher, twenty-seven years later, and the fix that looks like doing nothing.
-
Algorithm confusion: when alg comes from the wrong header
A single array spread, and the algorithm a verifier trusts came from a header nobody signed. GHSA-jc38-x7x8-2xc8, found and fixed in JWT-Framework.
-
On the road to JWT-Framework 1.2
At the end of this month, April 2018, version 1.1.0 of web-token/jwt-framework will be released along with all its components (see the previous article). It also marks the creation of a new branch: v1.2.
-
JWT-Framework v1.1.0
Almost four months after the first stable release of JWT-Framework, a new version is about to ship. It is a minor release, but it brings a number of changes. Here are the main ones.