Roles using JWT

Question

I am new to JWT. I studied a bit about JWT and understood that it is framed as "header.claims.signature".

Consider a simple scenario as follows:

• A customer gets authenticated
• Customer may have (one or more) roles of admin, member, registered, guest
• The server does not maintain any session (and depends solely on JWT for authentication/authorization)

Once authenticated, the server finds the type of customer and I am assuming that the customerId and the roles will be part of "claims" in JWT. Let me know if my assumption is incorrect (or against standard).

The "claims" part of JWT is not encrypted (just encoded). That exposes an easy security hole, where the (service) consumer can simply modify "claims" part of JWT and resend the same with more roles (for which the customer/consumer is not authorized to).

If my understanding/assumption is incorrect, how do we achieve to what I am targeting?

Answer 1

When using JWS (header.claims.signature), the "claims" part of the JWT is integrity protected by the signature. So if the "claims" or any other part of the JWT is modified by someone without the proper key, the signature verification on the JWT will fail and the token should be rejected.

Answer 2

The claims part of JWT can be verified, but another issue when adding something like roles to claims is the case when you change user roles, but the old token still contains the previous roles assigned to the user. So be careful about it. You can simply keep user identifier in the token and retrieve any other information associated with the user based on your persistence mechanism (databases or anything else).