SlideShare a Scribd company logo
1 of 128
Download to read offline
WTH IS A JWT
IT’S NOT PRONOUNCED ‘JOT’
WTH IS A JWT
IT’S NOT PRONOUNCED ‘JOT’
@joel__lord #AllThingsOpen
WTH IS A JWT
ABOUT ME
@joel__lord
joellord
@joel__lord #AllThingsOpen
WTH IS A JWT
SPA BEST PRACTICES
@joel__lord #AllThingsOpen
WTH IS A JWT
SPA BEST PRACTICES
▸ …
@joel__lord
joellord
All Things Open, Raleigh, NC
October 23th, 2018
THANK YOU
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
https://myserver.com
@joel__lord #AllThingsOpen
https://myserver.com
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
🔗
@joel__lord #AllThingsOpen
https://myserver.com User
🔗
⛔
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://myserver.com User
@joel__lord #AllThingsOpen
https://api.myserver.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
❓
JSON WEB
TOKENS
INTRODUCING
@joel__lord #AllThingsOpen
WTH IS A JWT
JSON WEB TOKENS
▸ JWT's (RFC 7519) are an open
industry standard  method for
representing claims securely
between two parties.
@joel__lord #AllThingsOpen
WTH IS A JWT
JSON WEB TOKENS
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp
XVCJ9.eyJzdWIiOjEsInNjb3BlIjoiY
XBpOnJlYWQiLCJ1c2VybmFtZSI6I
mpvZWxsb3JkIiwiaXNzIjoibXktc21
hbGwtYXV0aC1zZXJ2ZXIiLCJhdW
QiOiJteS1yYW5kb20tY2xpY2tiYW
l0LWFwaSIsImlhdCI6MTUzNzg5M
TQyOCwiZXhwIjoxNTM3ODkyMDI
4fQ.gEY3pRSdrnK5VtJI6E9vgada
OQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
A SIMPLE ANALOGY
▸ How is a Drivers License like a JSON Web Token?
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp
XVCJ9.eyJzdWIiOjEsInNjb3BlIjoiY
XBpOnJlYWQiLCJ1c2VybmFtZSI6I
mpvZWxsb3JkIiwiaXNzIjoibXktc21
hbGwtYXV0aC1zZXJ2ZXIiLCJhdW
QiOiJteS1yYW5kb20tY2xpY2tiYW
l0LWFwaSIsImlhdCI6MTUzNzg5M
TQyOCwiZXhwIjoxNTM3ODkyMDI
4fQ.gEY3pRSdrnK5VtJI6E9vgada
OQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
A SIMPLE ANALOGY
▸ How is a Drivers License like a JSON Web Token?
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp
XVCJ9.eyJzdWIiOjEsInNjb3BlIjoiY
XBpOnJlYWQiLCJ1c2VybmFtZSI6I
mpvZWxsb3JkIiwiaXNzIjoibXktc21
hbGwtYXV0aC1zZXJ2ZXIiLCJhdW
QiOiJteS1yYW5kb20tY2xpY2tiYW
l0LWFwaSIsImlhdCI6MTUzNzg5M
TQyOCwiZXhwIjoxNTM3ODkyMDI
4fQ.gEY3pRSdrnK5VtJI6E9vgada
OQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
▸ Drivers Licence
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
▸ Drivers Licence
▸ Province of Quebec
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
▸ eyJhbGciOiJIUzI1NiIsInR5c
CI6IkpXVCJ9
▸ Drivers Licence
▸ Province of Quebec
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
▸ atob(“eyJhbGciOiJIUzI1NiI
sInR5cCI6IkpXVCJ9”);
▸ Drivers Licence
▸ Province of Quebec
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
HEADER
{
"alg": "HS256",
"typ": "JWT"
}
▸ Drivers Licence
▸ Province of Quebec
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
▸ Picture
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
▸ Picture
▸ Name
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
▸ Picture
▸ Name
▸ Date of Birth
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
▸ Picture
▸ Name
▸ Date of Birth
▸ Restrictions
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
eyJzdWIiOjEsInNjb3BlIjoiYXBpOnJlYWQiL
CJ1c2VybmFtZSI6ImpvZWxsb3JkIiwiaXNzI
joibXktc21hbGwtYXV0aC1zZXJ2ZXIiLCJhd
WQiOiJteS1yYW5kb20tY2xpY2tiYWl0LWF
waSIsImlhdCI6MTUzNzg5MTQyOCwiZXhw
IjoxNTM3ODkyMDI4fQ
▸ Picture
▸ Name
▸ Date of Birth
▸ Restrictions
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
atob(“eyJzdWIiOjEsInNjb3BlIjoiYXBpOnJlY
WQiLCJ1c2VybmFtZSI6ImpvZWxsb3JkIiwi
aXNzIjoibXktc21hbGwtYXV0aC1zZXJ2ZXIi
LCJhdWQiOiJteS1yYW5kb20tY2xpY2tiYW
l0LWFwaSIsImlhdCI6MTUzNzg5MTQyOCw
iZXhwIjoxNTM3ODkyMDI4fQ”);
▸ Picture
▸ Name
▸ Date of Birth
▸ Restrictions
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
PAYLOAD
{
"sub": 1,
"scope": "api:read",
"username": "joellord",
"iss": "my-small-auth-server",
"aud": "my-random-clickbait-api",
"iat": 1537891428,
"exp": 1537892028
}
▸ Picture
▸ Name
▸ Date of Birth
▸ Restrictions
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
▸ Holograms
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
▸ Holograms
▸ Signature
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
gEY3pRSdrnK5VtJI6E9vgada
OQuLNWILBvvGasR4CRk
▸ Holograms
▸ Signature
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
HMACSHA256(
`${header}.${payload}`,
“mysupersecret”
);
▸ Holograms
▸ Signature
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
HMACSHA256(
`${header}.${payload}`,
“mysupersecret”
);
▸ Holograms
▸ Signature
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
SIGNATURE
HMACSHA256(
`${header}.${payload}`,
“mysupersecret”
);
▸ Holograms
▸ Signature
▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW
IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt
ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY
XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t
Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT
QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd
rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
📝
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
📝
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
📝
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
📝
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
📝
👍
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
💰
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
💰
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
💰
@joel__lord #AllThingsOpen
WTH IS A JWT
A TOKEN WALKS INTO A BAR
💰
✋
DEMO
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
/api/cats
🔗
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
/api/book
🔗
✋
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
/api/cats
🔗
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
https://api.myserver.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen
https://api.myserver.com https://myapplication.com https://login.myserver.com
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
/authorize
@joel__lord #AllThingsOpen
/authorize
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
/api/cats
@joel__lord #AllThingsOpen
/api/cats
@joel__lord #AllThingsOpen
/api/cats
@joel__lord #AllThingsOpen
WTH IS A JWT
SENDING THE TOKEN TO THE API
▸ Using Axios
@joel__lord #AllThingsOpen
WTH IS A JWT
SENDING THE TOKEN TO THE API
▸ Using Fetch
@joel__lord #AllThingsOpen
WTH IS A JWT
SENDING THE TOKEN TO THE API
@joel__lord #AllThingsOpen
❓
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
/authorize
@joel__lord #AllThingsOpen
/authorize
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
🔄
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
▸ You can never completely secure your front-end using
JWTs
▸ You can “hide” some routes
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
WTH IS A JWT
“SECURING” YOUR SPA
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
)
@joel__lord #AllThingsOpen
WTH IS A JWT
RESOURCES
▸ General JWT resource
▸ jwt.io
@joel__lord #AllThingsOpen
WTH IS A JWT
RESOURCES
▸ General JWT resource
▸ jwt.io
▸ Overview of JWT Signing Algorithms
▸ bit.ly/jwt-alg
@joel__lord #AllThingsOpen
WTH IS A JWT
RESOURCES
▸ General JWT resource
▸ jwt.io
▸ Overview of JWT Signing Algorithms
▸ bit.ly/jwt-alg
▸ JWT Handbook
▸ bit.ly/jwt-book
@joel__lord #AllThingsOpen
WTH IS A JWT
SUMMARY
▸ Single Page Application security is mainly concerned
with authorization. 
@joel__lord #AllThingsOpen
WTH IS A JWT
SUMMARY
▸ Single Page Application security is mainly concerned
with authorization. 
▸ JSON Web Tokens are excellent for securing SPA
applications.
@joel__lord #AllThingsOpen
WTH IS A JWT
SUMMARY
▸ Single Page Application security is mainly concerned
with authorization. 
▸ JSON Web Tokens are excellent for securing SPA
applications.
▸ Many excellent JWT Libraries exist for all languages and
frameworks.
@joel__lord
joellord
All Things Open, Raleigh, NC
October 23rd, 2018
THANK YOU
TEXT
TEXT

More Related Content

More from Joel Lord

More from Joel Lord (20)

Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
WTH is a JWT
WTH is a JWTWTH is a JWT
WTH is a JWT
 
Asynchonicity: concurrency. A tale of
Asynchonicity: concurrency. A tale ofAsynchonicity: concurrency. A tale of
Asynchonicity: concurrency. A tale of
 
I Don't Care About Security
I Don't Care About Security I Don't Care About Security
I Don't Care About Security
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
Secure your SPA with Auth0
Secure your SPA with Auth0Secure your SPA with Auth0
Secure your SPA with Auth0
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Rise of the Nodebots
Rise of the NodebotsRise of the Nodebots
Rise of the Nodebots
 
Let's Get Physical
Let's Get PhysicalLet's Get Physical
Let's Get Physical
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Apprendre l'apprentissage automatisé
Apprendre l'apprentissage automatiséApprendre l'apprentissage automatisé
Apprendre l'apprentissage automatisé
 

Recently uploaded

Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRLLucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
imonikaupta
 
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
Call Girls In Delhi Whatsup 9873940964 Enjoy Unlimited Pleasure
 
( Pune ) VIP Baner Call Girls 🎗️ 9352988975 Sizzling | Escorts | Girls Are Re...
( Pune ) VIP Baner Call Girls 🎗️ 9352988975 Sizzling | Escorts | Girls Are Re...( Pune ) VIP Baner Call Girls 🎗️ 9352988975 Sizzling | Escorts | Girls Are Re...
( Pune ) VIP Baner Call Girls 🎗️ 9352988975 Sizzling | Escorts | Girls Are Re...
nilamkumrai
 
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men 🔝mehsana🔝 Escorts...
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men  🔝mehsana🔝   Escorts...➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men  🔝mehsana🔝   Escorts...
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men 🔝mehsana🔝 Escorts...
nirzagarg
 
Thalassery Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call G...
Thalassery Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call G...Thalassery Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call G...
Thalassery Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call G...
Call Girls In Delhi Whatsup 9873940964 Enjoy Unlimited Pleasure
 
在线制作约克大学毕业证(yu毕业证)在读证明认证可查
在线制作约克大学毕业证(yu毕业证)在读证明认证可查在线制作约克大学毕业证(yu毕业证)在读证明认证可查
在线制作约克大学毕业证(yu毕业证)在读证明认证可查
ydyuyu
 

Recently uploaded (20)

VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...
VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...
VVIP Pune Call Girls Sinhagad WhatSapp Number 8005736733 With Elite Staff And...
 
20240508 QFM014 Elixir Reading List April 2024.pdf
20240508 QFM014 Elixir Reading List April 2024.pdf20240508 QFM014 Elixir Reading List April 2024.pdf
20240508 QFM014 Elixir Reading List April 2024.pdf
 
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort ServiceBusty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
Busty Desi⚡Call Girls in Vasundhara Ghaziabad >༒8448380779 Escort Service
 
All Time Service Available Call Girls Mg Road 👌 ⏭️ 6378878445
All Time Service Available Call Girls Mg Road 👌 ⏭️ 6378878445All Time Service Available Call Girls Mg Road 👌 ⏭️ 6378878445
All Time Service Available Call Girls Mg Road 👌 ⏭️ 6378878445
 
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls DubaiDubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
 
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRLLucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
 
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
 
( Pune ) VIP Baner Call Girls 🎗️ 9352988975 Sizzling | Escorts | Girls Are Re...
( Pune ) VIP Baner Call Girls 🎗️ 9352988975 Sizzling | Escorts | Girls Are Re...( Pune ) VIP Baner Call Girls 🎗️ 9352988975 Sizzling | Escorts | Girls Are Re...
( Pune ) VIP Baner Call Girls 🎗️ 9352988975 Sizzling | Escorts | Girls Are Re...
 
Hire↠Young Call Girls in Tilak nagar (Delhi) ☎️ 9205541914 ☎️ Independent Esc...
Hire↠Young Call Girls in Tilak nagar (Delhi) ☎️ 9205541914 ☎️ Independent Esc...Hire↠Young Call Girls in Tilak nagar (Delhi) ☎️ 9205541914 ☎️ Independent Esc...
Hire↠Young Call Girls in Tilak nagar (Delhi) ☎️ 9205541914 ☎️ Independent Esc...
 
Microsoft Azure Arc Customer Deck Microsoft
Microsoft Azure Arc Customer Deck MicrosoftMicrosoft Azure Arc Customer Deck Microsoft
Microsoft Azure Arc Customer Deck Microsoft
 
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men 🔝mehsana🔝 Escorts...
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men  🔝mehsana🔝   Escorts...➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men  🔝mehsana🔝   Escorts...
➥🔝 7737669865 🔝▻ mehsana Call-girls in Women Seeking Men 🔝mehsana🔝 Escorts...
 
Thalassery Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call G...
Thalassery Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call G...Thalassery Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call G...
Thalassery Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call G...
 
Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...
Pune Airport ( Call Girls ) Pune  6297143586  Hot Model With Sexy Bhabi Ready...Pune Airport ( Call Girls ) Pune  6297143586  Hot Model With Sexy Bhabi Ready...
Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...
 
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting  High Prof...VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting  High Prof...
VIP Model Call Girls Hadapsar ( Pune ) Call ON 9905417584 Starting High Prof...
 
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
WhatsApp 📞 8448380779 ✅Call Girls In Mamura Sector 66 ( Noida)
 
Russian Call Girls Pune (Adult Only) 8005736733 Escort Service 24x7 Cash Pay...
Russian Call Girls Pune  (Adult Only) 8005736733 Escort Service 24x7 Cash Pay...Russian Call Girls Pune  (Adult Only) 8005736733 Escort Service 24x7 Cash Pay...
Russian Call Girls Pune (Adult Only) 8005736733 Escort Service 24x7 Cash Pay...
 
在线制作约克大学毕业证(yu毕业证)在读证明认证可查
在线制作约克大学毕业证(yu毕业证)在读证明认证可查在线制作约克大学毕业证(yu毕业证)在读证明认证可查
在线制作约克大学毕业证(yu毕业证)在读证明认证可查
 
Real Men Wear Diapers T Shirts sweatshirt
Real Men Wear Diapers T Shirts sweatshirtReal Men Wear Diapers T Shirts sweatshirt
Real Men Wear Diapers T Shirts sweatshirt
 
Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...
Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...
Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...
 
Wadgaon Sheri $ Call Girls Pune 10k @ I'm VIP Independent Escorts Girls 80057...
Wadgaon Sheri $ Call Girls Pune 10k @ I'm VIP Independent Escorts Girls 80057...Wadgaon Sheri $ Call Girls Pune 10k @ I'm VIP Independent Escorts Girls 80057...
Wadgaon Sheri $ Call Girls Pune 10k @ I'm VIP Independent Escorts Girls 80057...
 

WTH is a JWT