How to authenticate JSON web tokens (JWT) across different APIs?

Question

I've created a Rest API based on the PHP Slim framework which uses JSON Web Tokens (JWT) to authenticate and authorize access.

To use the API the client must first authenticate themselves by sending their credentials to a special /auth/token route which if correct, returns a digitally signed token containing a list of allowed permissions. All subsequent requests to the API require the token for authentication and authorization. This is pretty standard stuff and works well.

But now I now want to separate the /auth/token service into its own micro-service so I can reuse it with other APIs in the future.

The problem is, how will the APIs now authenticate the JWT as they don't have access to the secret that was used to generate it?

I use the Firebase\JWT\JWT to generate the token, which will be moved to the new auth service. And I use tuupola/slim-jwt-auth middleware to authenticate the received token on each API.

As each API and the new auth service will be running on the same host I could maybe share the secret between them all but this feels like bad practice. Is there a better way?

Answer 1

It is better to sign JWT using private/public key (RSA or ECDSA algorithm) instead of a secret (HMAC algorithm). In that case your auth service would sign JWT with private key and other APIs would validate JWT with public key, well... you still need to distribute a public key to your APIs then, but you have options.

Depends on your architecture, you might look at:

API Gateway pattern

For microservice architecture a good practice is to use API Gateway pattern. More about gateway pattern. API Gateway can validate JWT token and then proxy requests to your services. So auth service would sign JWT token with private key, then requests to APIs would go though API Gateway. API Gateway would validate token with public key, so you would not distribute public key to all APIs behind the proxy.

With this approach your would need an API Gateway, you can look at: express-gateway, kong + jwt plugin, tyk etc, also there is much more benefits from API Gateway rather then just JWT token validation, like traffic control, analytics, logging, requests and responses transformations and so on.

Secrets management

Instead of or additionally to API Gateway you can take a look at centralised secrets management systems, like Hashi Vault. Depends on the project/team size it could be an overkill for your project.