SlideShare a Scribd company logo

WTH is a JWT

•
•
J
Joel Lord

Chances are sooner or later your shiny new single page application will need authentication. Add some security and resource access control to that list as well. But how can we integrate all of this into a single page application that is entirely public? How can we ensure that our users only have access to the resources they are authorized to by hacking way in via the console? In this talk, the attendees will learn about l JSON Web Tokens (JWT) and see how they can be used to properly secure single page applications.

Internet
1 of 128
Download to read offline
WTH IS A JWT IT’S NOT PRONOUNCED ‘JOT’
WTH IS A JWT IT’S NOT PRONOUNCED ‘JOT’
@joel__lord #AllThingsOpen WTH IS A JWT ABOUT ME @joel__lord joellord
@joel__lord #AllThingsOpen WTH IS A JWT SPA BEST PRACTICES
@joel__lord #AllThingsOpen WTH IS A JWT SPA BEST PRACTICES ▸ …
@joel__lord joellord All Things Open, Raleigh, NC October 23th, 2018 THANK YOU
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen https://myserver.com
@joel__lord #AllThingsOpen https://myserver.com
@joel__lord #AllThingsOpen https://myserver.com User
@joel__lord #AllThingsOpen https://myserver.com User
@joel__lord #AllThingsOpen https://myserver.com User
@joel__lord #AllThingsOpen https://myserver.com User
@joel__lord #AllThingsOpen https://myserver.com User 🔗
@joel__lord #AllThingsOpen https://myserver.com User 🔗 ⛔
@joel__lord #AllThingsOpen https://myserver.com User
@joel__lord #AllThingsOpen https://myserver.com User
@joel__lord #AllThingsOpen https://myserver.com User
@joel__lord #AllThingsOpen https://myserver.com User
@joel__lord #AllThingsOpen https://api.myserver.com
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com ❓
JSON WEB TOKENS INTRODUCING
@joel__lord #AllThingsOpen WTH IS A JWT JSON WEB TOKENS ▸ JWT's (RFC 7519) are an open industry standard  method for representing claims securely between two parties.
@joel__lord #AllThingsOpen WTH IS A JWT JSON WEB TOKENS ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp XVCJ9.eyJzdWIiOjEsInNjb3BlIjoiY XBpOnJlYWQiLCJ1c2VybmFtZSI6I mpvZWxsb3JkIiwiaXNzIjoibXktc21 hbGwtYXV0aC1zZXJ2ZXIiLCJhdW QiOiJteS1yYW5kb20tY2xpY2tiYW l0LWFwaSIsImlhdCI6MTUzNzg5M TQyOCwiZXhwIjoxNTM3ODkyMDI 4fQ.gEY3pRSdrnK5VtJI6E9vgada OQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT A SIMPLE ANALOGY ▸ How is a Drivers License like a JSON Web Token? ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp XVCJ9.eyJzdWIiOjEsInNjb3BlIjoiY XBpOnJlYWQiLCJ1c2VybmFtZSI6I mpvZWxsb3JkIiwiaXNzIjoibXktc21 hbGwtYXV0aC1zZXJ2ZXIiLCJhdW QiOiJteS1yYW5kb20tY2xpY2tiYW l0LWFwaSIsImlhdCI6MTUzNzg5M TQyOCwiZXhwIjoxNTM3ODkyMDI 4fQ.gEY3pRSdrnK5VtJI6E9vgada OQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT A SIMPLE ANALOGY ▸ How is a Drivers License like a JSON Web Token? ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp XVCJ9.eyJzdWIiOjEsInNjb3BlIjoiY XBpOnJlYWQiLCJ1c2VybmFtZSI6I mpvZWxsb3JkIiwiaXNzIjoibXktc21 hbGwtYXV0aC1zZXJ2ZXIiLCJhdW QiOiJteS1yYW5kb20tY2xpY2tiYW l0LWFwaSIsImlhdCI6MTUzNzg5M TQyOCwiZXhwIjoxNTM3ODkyMDI 4fQ.gEY3pRSdrnK5VtJI6E9vgada OQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT HEADER ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT HEADER ▸ Drivers Licence ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT HEADER ▸ Drivers Licence ▸ Province of Quebec ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT HEADER ▸ eyJhbGciOiJIUzI1NiIsInR5c CI6IkpXVCJ9 ▸ Drivers Licence ▸ Province of Quebec ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT HEADER ▸ atob(“eyJhbGciOiJIUzI1NiI sInR5cCI6IkpXVCJ9”); ▸ Drivers Licence ▸ Province of Quebec ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT HEADER { "alg": "HS256", "typ": "JWT" } ▸ Drivers Licence ▸ Province of Quebec ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT PAYLOAD ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT PAYLOAD ▸ Picture ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT PAYLOAD ▸ Picture ▸ Name ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT PAYLOAD ▸ Picture ▸ Name ▸ Date of Birth ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT PAYLOAD ▸ Picture ▸ Name ▸ Date of Birth ▸ Restrictions ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT PAYLOAD eyJzdWIiOjEsInNjb3BlIjoiYXBpOnJlYWQiL CJ1c2VybmFtZSI6ImpvZWxsb3JkIiwiaXNzI joibXktc21hbGwtYXV0aC1zZXJ2ZXIiLCJhd WQiOiJteS1yYW5kb20tY2xpY2tiYWl0LWF waSIsImlhdCI6MTUzNzg5MTQyOCwiZXhw IjoxNTM3ODkyMDI4fQ ▸ Picture ▸ Name ▸ Date of Birth ▸ Restrictions ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT PAYLOAD atob(“eyJzdWIiOjEsInNjb3BlIjoiYXBpOnJlY WQiLCJ1c2VybmFtZSI6ImpvZWxsb3JkIiwi aXNzIjoibXktc21hbGwtYXV0aC1zZXJ2ZXIi LCJhdWQiOiJteS1yYW5kb20tY2xpY2tiYW l0LWFwaSIsImlhdCI6MTUzNzg5MTQyOCw iZXhwIjoxNTM3ODkyMDI4fQ”); ▸ Picture ▸ Name ▸ Date of Birth ▸ Restrictions ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT PAYLOAD { "sub": 1, "scope": "api:read", "username": "joellord", "iss": "my-small-auth-server", "aud": "my-random-clickbait-api", "iat": 1537891428, "exp": 1537892028 } ▸ Picture ▸ Name ▸ Date of Birth ▸ Restrictions ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT SIGNATURE ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT SIGNATURE ▸ Holograms ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT SIGNATURE ▸ Holograms ▸ Signature ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT SIGNATURE gEY3pRSdrnK5VtJI6E9vgada OQuLNWILBvvGasR4CRk ▸ Holograms ▸ Signature ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT SIGNATURE HMACSHA256( `${header}.${payload}`, “mysupersecret” ); ▸ Holograms ▸ Signature ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT SIGNATURE HMACSHA256( `${header}.${payload}`, “mysupersecret” ); ▸ Holograms ▸ Signature ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT SIGNATURE HMACSHA256( `${header}.${payload}`, “mysupersecret” ); ▸ Holograms ▸ Signature ▸ eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdW IiOjEsInNjb3BlIjoiYXBpOnJlYWQiLCJ1c2VybmFt ZSI6ImpvZWxsb3JkIiwiaXNzIjoibXktc21hbGwtY XV0aC1zZXJ2ZXIiLCJhdWQiOiJteS1yYW5kb20t Y2xpY2tiYWl0LWFwaSIsImlhdCI6MTUzNzg5MT QyOCwiZXhwIjoxNTM3ODkyMDI4fQ.gEY3pRSd rnK5VtJI6E9vgadaOQuLNWILBvvGasR4CRk
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR 📝
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR 📝
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR 📝
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR 📝
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR 📝 👍
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR 💰
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR 💰
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR 💰
@joel__lord #AllThingsOpen WTH IS A JWT A TOKEN WALKS INTO A BAR 💰 ✋
DEMO
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com /api/cats 🔗
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com /api/book 🔗 ✋
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com /api/cats 🔗
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen https://api.myserver.com
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com
@joel__lord #AllThingsOpen https://api.myserver.com https://myapplication.com https://login.myserver.com
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen /authorize
@joel__lord #AllThingsOpen /authorize
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen /api/cats
@joel__lord #AllThingsOpen /api/cats
@joel__lord #AllThingsOpen /api/cats
@joel__lord #AllThingsOpen WTH IS A JWT SENDING THE TOKEN TO THE API ▸ Using Axios
@joel__lord #AllThingsOpen WTH IS A JWT SENDING THE TOKEN TO THE API ▸ Using Fetch
@joel__lord #AllThingsOpen WTH IS A JWT SENDING THE TOKEN TO THE API
@joel__lord #AllThingsOpen ❓
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen /authorize
@joel__lord #AllThingsOpen /authorize
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen 🔄
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA ▸ You can never completely secure your front-end using JWTs ▸ You can “hide” some routes
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen WTH IS A JWT “SECURING” YOUR SPA
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen
@joel__lord #AllThingsOpen )
@joel__lord #AllThingsOpen WTH IS A JWT RESOURCES ▸ General JWT resource ▸ jwt.io
@joel__lord #AllThingsOpen WTH IS A JWT RESOURCES ▸ General JWT resource ▸ jwt.io ▸ Overview of JWT Signing Algorithms ▸ bit.ly/jwt-alg
@joel__lord #AllThingsOpen WTH IS A JWT RESOURCES ▸ General JWT resource ▸ jwt.io ▸ Overview of JWT Signing Algorithms ▸ bit.ly/jwt-alg ▸ JWT Handbook ▸ bit.ly/jwt-book
@joel__lord #AllThingsOpen WTH IS A JWT SUMMARY ▸ Single Page Application security is mainly concerned with authorization. 
@joel__lord #AllThingsOpen WTH IS A JWT SUMMARY ▸ Single Page Application security is mainly concerned with authorization.  ▸ JSON Web Tokens are excellent for securing SPA applications.
@joel__lord #AllThingsOpen WTH IS A JWT SUMMARY ▸ Single Page Application security is mainly concerned with authorization.  ▸ JSON Web Tokens are excellent for securing SPA applications. ▸ Many excellent JWT Libraries exist for all languages and frameworks.
@joel__lord joellord All Things Open, Raleigh, NC October 23rd, 2018 THANK YOU
TEXT
TEXT

Recommended

From Ceasar Cipher To Quantum Cryptography
From Ceasar Cipher To Quantum CryptographyFrom Ceasar Cipher To Quantum Cryptography
From Ceasar Cipher To Quantum Cryptography
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
Mot de passe oublié? Absolument!
Mot de passe oublié? Absolument!Mot de passe oublié? Absolument!
Mot de passe oublié? Absolument!
Joel Lord
 
Asynchronicity: concurrency. A tale of
Asynchronicity: concurrency. A tale ofAsynchronicity: concurrency. A tale of
Asynchronicity: concurrency. A tale of
Joel Lord
 

Recommended

From Ceasar Cipher To Quantum Cryptography
From Ceasar Cipher To Quantum CryptographyFrom Ceasar Cipher To Quantum Cryptography
From Ceasar Cipher To Quantum Cryptography
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
Mot de passe oublié? Absolument!
Mot de passe oublié? Absolument!Mot de passe oublié? Absolument!
Mot de passe oublié? Absolument!
Joel Lord
 
Asynchronicity: concurrency. A tale of
Asynchronicity: concurrency. A tale ofAsynchronicity: concurrency. A tale of
Asynchronicity: concurrency. A tale of
Joel Lord
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
Joel Lord
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
WTH is a JWT
WTH is a JWTWTH is a JWT
WTH is a JWT
Joel Lord
 
Asynchonicity: concurrency. A tale of
Asynchonicity: concurrency. A tale ofAsynchonicity: concurrency. A tale of
Asynchonicity: concurrency. A tale of
Joel Lord
 
I Don't Care About Security
I Don't Care About Security I Don't Care About Security
I Don't Care About Security
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
Joel Lord
 
Secure your SPA with Auth0
Secure your SPA with Auth0Secure your SPA with Auth0
Secure your SPA with Auth0
Joel Lord
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
Joel Lord
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
Joel Lord
 
Rise of the Nodebots
Rise of the NodebotsRise of the Nodebots
Rise of the Nodebots
Joel Lord
 
Let's Get Physical
Let's Get PhysicalLet's Get Physical
Let's Get Physical
Joel Lord
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
Joel Lord
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
Joel Lord
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
Joel Lord
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
Joel Lord
 
Apprendre l'apprentissage automatisé
Apprendre l'apprentissage automatiséApprendre l'apprentissage automatisé
Apprendre l'apprentissage automatisé
Joel Lord
 
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
EleniIlkou
 
Abu Dhabi Escorts Service 0508644382 Escorts in Abu Dhabi
Abu Dhabi Escorts Service 0508644382 Escorts in Abu DhabiAbu Dhabi Escorts Service 0508644382 Escorts in Abu Dhabi
Abu Dhabi Escorts Service 0508644382 Escorts in Abu Dhabi
Monica Sydney
 

More Related Content

More from Joel Lord

I Don't Care About Security
I Don't Care About Security I Don't Care About Security
I Don't Care About Security
Joel Lord
 

More from Joel Lord (20)

Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
Forgot Password? Yes I Did!
Forgot Password? Yes I Did!Forgot Password? Yes I Did!
Forgot Password? Yes I Did!
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
WTH is a JWT
WTH is a JWTWTH is a JWT
WTH is a JWT
 
Asynchonicity: concurrency. A tale of
Asynchonicity: concurrency. A tale ofAsynchonicity: concurrency. A tale of
Asynchonicity: concurrency. A tale of
 
I Don't Care About Security
I Don't Care About Security I Don't Care About Security
I Don't Care About Security
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)I Don't Care About Security (And Neither Should You)
I Don't Care About Security (And Neither Should You)
 
Secure your SPA with Auth0
Secure your SPA with Auth0Secure your SPA with Auth0
Secure your SPA with Auth0
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Rise of the Nodebots
Rise of the NodebotsRise of the Nodebots
Rise of the Nodebots
 
Let's Get Physical
Let's Get PhysicalLet's Get Physical
Let's Get Physical
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
 
Learning About Machine Learning
Learning About Machine LearningLearning About Machine Learning
Learning About Machine Learning
 
Learning Machine Learning
Learning Machine LearningLearning Machine Learning
Learning Machine Learning
 
Apprendre l'apprentissage automatisé
Apprendre l'apprentissage automatiséApprendre l'apprentissage automatisé
Apprendre l'apprentissage automatisé
 

Recently uploaded

2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
EleniIlkou
 
Abu Dhabi Escorts Service 0508644382 Escorts in Abu Dhabi
Abu Dhabi Escorts Service 0508644382 Escorts in Abu DhabiAbu Dhabi Escorts Service 0508644382 Escorts in Abu Dhabi
Abu Dhabi Escorts Service 0508644382 Escorts in Abu Dhabi
Monica Sydney
 
call girls in Anand Vihar (delhi) call me [🔝9953056974🔝] escort service 24X7
call girls in Anand Vihar (delhi) call me [🔝9953056974🔝] escort service 24X7call girls in Anand Vihar (delhi) call me [🔝9953056974🔝] escort service 24X7
call girls in Anand Vihar (delhi) call me [🔝9953056974🔝] escort service 24X7
9953056974 Low Rate Call Girls In Saket, Delhi NCR
 
在线制作约克大学毕业证（yu毕业证）在读证明认证可查
在线制作约克大学毕业证（yu毕业证）在读证明认证可查在线制作约克大学毕业证（yu毕业证）在读证明认证可查
在线制作约克大学毕业证（yu毕业证）在读证明认证可查
ydyuyu
 
Mira Road Housewife Call Girls 07506202331, Nalasopara Call Girls
Mira Road Housewife Call Girls 07506202331, Nalasopara Call GirlsMira Road Housewife Call Girls 07506202331, Nalasopara Call Girls
Mira Road Housewife Call Girls 07506202331, Nalasopara Call Girls
Priya Reddy
 
Call girls Service in Ajman 0505086370 Ajman call girls
Call girls Service in Ajman 0505086370 Ajman call girlsCall girls Service in Ajman 0505086370 Ajman call girls
Call girls Service in Ajman 0505086370 Ajman call girls
Monica Sydney
 
一比一原版(Curtin毕业证书)科廷大学毕业证原件一模一样
一比一原版(Curtin毕业证书)科廷大学毕业证原件一模一样一比一原版(Curtin毕业证书)科廷大学毕业证原件一模一样
一比一原版(Curtin毕业证书)科廷大学毕业证原件一模一样
ayvbos
 
Indian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
Indian Escort in Abu DHabi 0508644382 Abu Dhabi EscortsIndian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
Indian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
Monica Sydney
 
一比一原版田纳西大学毕业证如何办理
一比一原版田纳西大学毕业证如何办理一比一原版田纳西大学毕业证如何办理
一比一原版田纳西大学毕业证如何办理
F
 
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdfpdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
JOHNBEBONYAP1
 
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girlsRussian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Monica Sydney
 

Recently uploaded (20)

2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
 
Abu Dhabi Escorts Service 0508644382 Escorts in Abu Dhabi
Abu Dhabi Escorts Service 0508644382 Escorts in Abu DhabiAbu Dhabi Escorts Service 0508644382 Escorts in Abu Dhabi
Abu Dhabi Escorts Service 0508644382 Escorts in Abu Dhabi
 
call girls in Anand Vihar (delhi) call me [🔝9953056974🔝] escort service 24X7
call girls in Anand Vihar (delhi) call me [🔝9953056974🔝] escort service 24X7call girls in Anand Vihar (delhi) call me [🔝9953056974🔝] escort service 24X7
call girls in Anand Vihar (delhi) call me [🔝9953056974🔝] escort service 24X7
 
"Boost Your Digital Presence: Partner with a Leading SEO Agency"
"Boost Your Digital Presence: Partner with a Leading SEO Agency""Boost Your Digital Presence: Partner with a Leading SEO Agency"
"Boost Your Digital Presence: Partner with a Leading SEO Agency"
 
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
 
在线制作约克大学毕业证（yu毕业证）在读证明认证可查
在线制作约克大学毕业证（yu毕业证）在读证明认证可查在线制作约克大学毕业证（yu毕业证）在读证明认证可查
在线制作约克大学毕业证（yu毕业证）在读证明认证可查
 
Mira Road Housewife Call Girls 07506202331, Nalasopara Call Girls
Mira Road Housewife Call Girls 07506202331, Nalasopara Call GirlsMira Road Housewife Call Girls 07506202331, Nalasopara Call Girls
Mira Road Housewife Call Girls 07506202331, Nalasopara Call Girls
 
Call girls Service in Ajman 0505086370 Ajman call girls
Call girls Service in Ajman 0505086370 Ajman call girlsCall girls Service in Ajman 0505086370 Ajman call girls
Call girls Service in Ajman 0505086370 Ajman call girls
 
一比一原版(Curtin毕业证书)科廷大学毕业证原件一模一样
一比一原版(Curtin毕业证书)科廷大学毕业证原件一模一样一比一原版(Curtin毕业证书)科廷大学毕业证原件一模一样
一比一原版(Curtin毕业证书)科廷大学毕业证原件一模一样
 
Indian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
Indian Escort in Abu DHabi 0508644382 Abu Dhabi EscortsIndian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
Indian Escort in Abu DHabi 0508644382 Abu Dhabi Escorts
 
Nagercoil Escorts Service Girl ^ 9332606886, WhatsApp Anytime Nagercoil
Nagercoil Escorts Service Girl ^ 9332606886, WhatsApp Anytime NagercoilNagercoil Escorts Service Girl ^ 9332606886, WhatsApp Anytime Nagercoil
Nagercoil Escorts Service Girl ^ 9332606886, WhatsApp Anytime Nagercoil
 
Vip Firozabad Phone 8250092165 Escorts Service At 6k To 30k Along With Ac Room
Vip Firozabad Phone 8250092165 Escorts Service At 6k To 30k Along With Ac RoomVip Firozabad Phone 8250092165 Escorts Service At 6k To 30k Along With Ac Room
Vip Firozabad Phone 8250092165 Escorts Service At 6k To 30k Along With Ac Room
 
一比一原版田纳西大学毕业证如何办理
一比一原版田纳西大学毕业证如何办理一比一原版田纳西大学毕业证如何办理
一比一原版田纳西大学毕业证如何办理
 
Trump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts SweatshirtTrump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts Sweatshirt
 
20240510 QFM016 Irresponsible AI Reading List April 2024.pdf
20240510 QFM016 Irresponsible AI Reading List April 2024.pdf20240510 QFM016 Irresponsible AI Reading List April 2024.pdf
20240510 QFM016 Irresponsible AI Reading List April 2024.pdf
 
Meaning of On page SEO & its process in detail.
Meaning of On page SEO & its process in detail.Meaning of On page SEO & its process in detail.
Meaning of On page SEO & its process in detail.
 
APNIC Updates presented by Paul Wilson at ARIN 53
APNIC Updates presented by Paul Wilson at ARIN 53APNIC Updates presented by Paul Wilson at ARIN 53
APNIC Updates presented by Paul Wilson at ARIN 53
 
20240508 QFM014 Elixir Reading List April 2024.pdf
20240508 QFM014 Elixir Reading List April 2024.pdf20240508 QFM014 Elixir Reading List April 2024.pdf
20240508 QFM014 Elixir Reading List April 2024.pdf
 
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdfpdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
 
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girlsRussian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
 

WTH is a JWT