Menu
What happend if someone sniff the network and catch my entire request from my REST with the token? This person could send again the same packet and Impact without any problem right? Of course he's not going to know from which user is that packet, but he could impact anyway right? is this possible? How can lead with this situation?
Thanks! Matt.
915
JWT's are often not encrypted so anyone able to perform a man-in-the-middle attack and sniff the JWT now has your authentication credentials. This is made easier because the MITM attack only needs to be completed on the connection between the server and the client.
For instance, if an attacker gets hold of your JWT, they could start sending requests to the server identifying themselves as you and perform actions like making service changes, user account updates, etc. Once an attacker has your JWT, it's game over.
Claims constitute the payload part of a JSON web token and represent a set of information exchanged between two parties. The JWT standard distinguishes between reserved claims, public claims, and private claims. In API Gateway context, both public claims and private claims are considered custom claims.
there is a system where JWT tokens can be created without invalidating the other, they self-expire after 30 min. So I can get a JWT once, and then make a bunch of requests within 30 min, and if you continue making requests with the same JWT after 30 min, you'll get unauthorized.
What happend if someone sniff the network and catch my entire request from my REST with the token?
The JWT is the authentication token, so he could impersonate the user.
This person could send again the same packet and Impact without any problem right?
The same packet or any other because if has the authentication token. It is the same case as if the user had lost your username / password
Of course he's not going to know from which user is that packet, but he could impact anyway right?
Yes, he can know the user, it could know simply decoding the 'sub' field of the token. This field, as defined in RFC , identifies the principal that is the subject of the JWT. The attacker could use your own api to obtain or modify any information to which it has access
is this possible? How can lead with this situation?
Mainly use HTTPS to avoid man-in-the-middle and keep the tokens private. Set also expiration and renew tokens periodically
192
Of course, the attacker can use the token and get the same access as the victim.
If you want to limit attacker's actions, you need to perform several conditions:
43
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
