[
https://issues.apache.org/jira/browse/OFBIZ-9833?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16649467#comment-16649467
]
Jacques Le Roux commented on OFBIZ-9833:
----------------------------------------
While reviewing things for OFBIZ-10307, I stumbled upon the "replay attacks"
point in [https://stormpath.com/blog/jwt-the-right-way]. It says:
{quote}If you worried about replay attacks, include a nonce *(jti claim)*,
expiration time (exp claim), and creation time (iat claim) in the claims. These
are well defined in the JWT Spec.
{quote}
We already have exp and iat claim. We could add a jti claim using something
similar to what is in ExternalLoginKeysManager::getExternalLoginKey. That would
works as long as the same machine/session is used. But for a feature like
OFBIZ-10307 (different sessions on differents servers on different domains) we
can't put the externalKey in the externalLoginKeys. We can't even store it in
the source DB, since the target DB may be different. So it's impossible to
validate the JWT on the target machine, the jti being unique.
What we though could do is to use a non fixed jti claim (as types for
JWTManager::validateToken) for (most) cases which, unlike for OFBIZ-10307, are
handled with the same session on the same machine. Also maybe a solution
OFBIZ-10307 for would be to have an acces to the DB on the target machine from
the source machine. Here is an interesting discussion on this subject
[https://stackoverflow.com/questions/28907831/how-to-use-jti-claim-in-a-jwt]
> Token Based Authentication
> --------------------------
>
> Key: OFBIZ-9833
> URL: https://issues.apache.org/jira/browse/OFBIZ-9833
> Project: OFBiz
> Issue Type: New Feature
> Components: framework
> Reporter: Deepak Dixit
> Assignee: Deepak Dixit
> Priority: Major
> Attachments: JSON Web Tokens.pdf, OFBIZ-9833-JWTManager.patch, Token
> Based Authentication in Apache OfBiz.pdf, Token Based Authentication.pdf,
> rfc7519.pdf
>
>
> Here is dev list discussion for token based authentication work:
> http://markmail.org/message/vyskeh2wujqpkbwg
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
