...
| Code Block | ||
|---|---|---|
| ||
{
"sub": "<username>",
"role": "<user_role">,
"context": "<hashed_cookie_context">,
"iat": "<issue_date">,
"exp": "<expiration_date">
} |
Variable | Description |
|---|---|
| The username of the authorized user. |
| The role of the user. |
| The hashed context of the session. This will be compared to a sent cookie. See the “Potential Vulnerabilities” section for more details. |
| (Built-in to JWT) The date the token was issued. Note that the date is the number of seconds since Jan 1 1970. This is the equivalent of Javascript |
| The date the token expires. |
Token Attainment
The method by which the token will be securely obtained by the Safe Places web app.
...
An attacker may steal the token from the authorized user and use it for nefarious purposes. To mitigate this attack, we will employ token contextualization.
We generate a random string during the authentication phase and send it to the client as a cookie.
The cookie must have the flags
HttpOnly,Secure, andSameSite.
We store a SHA256 hash of the random string in the token as
context.
During token validation, we hash compare the token context in the token and compare it with the sent cookie. If they are different, then reject the request.
...