_notebooks/2023-12-19-JWTLesson.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "- title: JWT, Security Lesson\n",
    "- description: JWT, Security Lesson \n",
    "- layout: post\n",
    "- courses: { csa: {week: 15} }\n",
    "- categories: [C4.0]\n",
    "- type: tangibles\n",
    "---"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<h1>JWT - Java, Security Lesson </h1>\n",
    "Period 1 - Emma, Vivian, Grace, Aliya, Kevin, Isabelle"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## What is JWT\n",
    "- JSON Web Token (JWT)\n",
    "    - popular way to authenticate users in a web application. It is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is digitally signed using JSON Web Signature (JWS).\n",
    "    - Compact, url safe means of representing claims to securely transmit information between parties.\n",
    "        - These claims are encoded as JSON objects that are digitally signed using a JSON web signature\n",
    "    - Concise and efficient representation, allows for ease of transmissions over networks\n",
    "    - No need to reference external source/database to validate info\n",
    "- Common use cases:\n",
    "    - Authentication\n",
    "    - information exchange\n",
    "    - Authorization\n",
    "    - Secure your APIs!\n",
    "\n",
    "Popcorn hack: list 3 real world applications of JWT: Google Identification, Personal Identification, Banks"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Why do you need JWT\n",
    "JSON Web Tokens (JWT) are crucial for secure and efficient user authentication in web development. \n",
    "- They help manage user identity and sessions across different parts of a system. \n",
    "- They play a key role in stateless authentication, allowing servers to verify user identity without storing session data.\n",
    "- JWTs are especially useful in decentralized systems, enabling smooth communication between different services and ensuring secure user roles and permissions. \n",
    "- JWTs simplify and enhance user authentication in modern web development."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<h1>Components of JWT</h1>\n",
    "\n",
    "- What is a web token?\n",
    "    - A web token is a piece of information that represents a user's identity or session and is used for authentication and authorization in web applications. It is typically a string of characters, often encoded in a JSON format, and is digitally signed to ensure its integrity.\n",
    "\n",
    "- This is the structure of a JSON Web Token: \n",
    "\n",
    "1. Header\n",
    "    - The header typically consists of two parts: the type of the **token**, which is JWT, and the **algorithm** that is used, such as HMAC SHA256 or RSA SHA256. It is Base64Url encoded to form the first part of the JWT\n",
    "2. Payload\n",
    "    - Claims and user data\n",
    "    - claims are statements about the entity (users)\n",
    "    - There are three types of claims: \n",
    "        - registered: predefined claims that are no mandatory but recommended\n",
    "        - **public**: claims defined within the IA and JSON web token registry\n",
    "        - private: custom claims created to share information between parties that agree to using them\n",
    "3. Signature\n",
    "    - Ensuring integrity and authenticity\n",
    "    - verify the sender of the JWT\n",
    "    - function\n",
    "        - Creating a signature\n",
    "        - Verification process\n",
    "        - Signature tampering activity"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<h1>Deep Dive into Anatomy of JWT</h1>\n",
    "\n",
    "- Navigate to this website: [Link](https://jwt.io/)\n",
    "\n",
    "Encoded: Json Web Token (what you send to and from the client)\n",
    "Decoded: algorithm, data, verify token hasn't been changed\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<span style=\"color:red;\">eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.<span style=\"color:purple;\">eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.<span style=\"color:blue;\">SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "// header\n",
    "{\n",
    "    \"alg\": \"HS256\", //type of sign in algorithm used for encoding and decoding\n",
    "    \"typ\": \"JWT\"    //type of token\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- Base 64 encoded\n",
    "- useful to signature type to decode"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "// payload\n",
    "{\n",
    "\"sub\": \"123\", //example of a registered claim\n",
    "\"name\": \"jwt lesson\",\n",
    "\"iat\": 1516239022\",\n",
    "\"authorities\": [\n",
    "    \"ADMIN\",\n",
    "    \"MANAGER\"\n",
    "],\n",
    "\"extra-claims\": \"some data here\"\n",
    "}\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- where all different data for applciation is\n",
    "- sub = subject : id of user you're authenticating\n",
    "- iat = issued at (when token was created)\n",
    "- exp/eat = expired at (date when toke becomes invalid)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "//signature\n",
    "{\n",
    "HMACSHA256(\n",
    "    base64UrlEncode(header) + \".\" +\n",
    "    base64UrlEncode(payload),\n",
    "    your-256-bit-secret\n",
    ") secret base64 encoded\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "- verify user does not change with token before it is sent back to you\n",
    "- input your secret key\n",
    "- uses algorithm in header to encode data (header + payload) using specific secret key\n",
    "- if header/payload is changed, signature will not match"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Header"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "JWT Header: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\n"
     ]
    }
   ],
   "source": [
    "import java.util.Base64;\n",
    "\n",
    "public class JwtHeaderExample {\n",
    "    public static void main(String[] args) {\n",
    "        // JWT Header\n",
    "        String algorithm = \"HS256\";\n",
    "        String type = \"JWT\";\n",
    "\n",
    "        // Combine Header properties\n",
    "        String header = \"{\\\"alg\\\":\\\"\" + algorithm + \"\\\",\\\"typ\\\":\\\"\" + type + \"\\\"}\";\n",
    "\n",
    "        // Base64 URL encode the header\n",
    "        String base64UrlHeader = Base64.getUrlEncoder().encodeToString(header.getBytes());\n",
    "\n",
    "        System.out.println(\"JWT Header: \" + base64UrlHeader);\n",
    "    }\n",
    "}\n",
    "\n",
    "// Run this code\n",
    "JwtHeaderExample.main(null);\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Payload"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import java.util.Base64;\n",
    "import java.util.HashMap;\n",
    "import java.util.Map;\n",
    "\n",
    "public class JwtPayloadExample {\n",
    "    public static void main(String[] args) {\n",
    "        // JWT Payload (Claims)\n",
    "        Map<String, Object> claims = new HashMap<>();\n",
    "        claims.put(\"name\", \"Grace\");\n",
    "        claims.put(\"class\", \"CSA\");\n",
    "        claims.put(\"exp\", System.currentTimeMillis() + 1800000); // 30 minutes expiration\n",
    "\n",
    "        // Convert Claims to JSON and Base64 URL encode the payload\n",
    "        String payload = mapToJson(claims);\n",
    "        String base64UrlPayload = Base64.getUrlEncoder().encodeToString(payload.getBytes());\n",
    "\n",
    "        System.out.println(\"JWT Payload: \" + base64UrlPayload);\n",
    "    }\n",
    "\n",
    "    private static String mapToJson(Map<String, Object> map) {\n",
    "        // Implement JSON conversion logic (use your preferred approach)\n",
    "        return \"{ \\\"customKey\\\": \\\"customValue\\\" }\";\n",
    "    }\n",
    "}\n",
    "\n",
    "// Run This Code\n",
    "JwtPayloadExample.main(null);"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Signature"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import javax.crypto.Mac;\n",
    "import javax.crypto.spec.SecretKeySpec;\n",
    "import java.nio.charset.StandardCharsets;\n",
    "import java.security.InvalidKeyException;\n",
    "import java.security.NoSuchAlgorithmException;\n",
    "import java.util.Base64;\n",
    "\n",
    "public class JwtSignatureExample {\n",
    "    public static void main(String[] args) {\n",
    "        // Secret key for encoding and decoding\n",
    "        String secretKey = \"your secret key\";\n",
    "\n",
    "        // Combine Header and Payload with a period '.'\n",
    "        String base64UrlHeader = \"base64UrlHeader\"; // Placeholder for the actual base64UrlHeader\n",
    "        String base64UrlPayload = \"base64UrlPayload\"; // Placeholder for the actual base64UrlPayload\n",
    "        String headerPayload = base64UrlHeader + \".\" + base64UrlPayload;\n",
    "\n",
    "        // Generate HMAC SHA-256 signature\n",
    "        byte[] signature = HmacSha256(headerPayload, secretKey);\n",
    "\n",
    "        // Base64 URL encode the signature\n",
    "        String base64UrlSignature = Base64.getUrlEncoder().encodeToString(signature);\n",
    "\n",
    "        System.out.println(\"JWT Signature: \" + base64UrlSignature);\n",
    "    }\n",
    "\n",
    "    private static byte[] HmacSha256(String data, String key) {\n",
    "        try {\n",
    "            Mac sha256Hmac = Mac.getInstance(\"HmacSHA256\");\n",
    "            SecretKeySpec secretKey = new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), \"HmacSHA256\");\n",
    "            sha256Hmac.init(secretKey);\n",
    "            return sha256Hmac.doFinal(data.getBytes(StandardCharsets.UTF_8));\n",
    "        } catch (NoSuchAlgorithmException | InvalidKeyException e) {\n",
    "            throw new RuntimeException(\"Error while generating HMAC SHA-256\", e);\n",
    "        }\n",
    "    }\n",
    "}\n",
    "\n",
    "// Run\n",
    "JwtSignatureExample.main(null);"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<h3>Putting It Together</h3>\n",
    "\n",
    "Popcorn hack: write some comments that identify each part of the JWT\n",
    "- Header: The header of a JWT contains metadata, specifying the token type and the signing algorithm chosen for securing the data.\n",
    "\n",
    "- Payload: At the core of the JWT, the payload holds encoded claims providing information about the user or entity, influencing authorization and other functionalities.\n",
    "\n",
    "- Signature: Ensuring the JWT's integrity, the signature is a cryptographic hash generated from the header, payload, and a secret key, allowing verification of the token's authenticity.\n",
    "\n",
    "- Algorithm: The algorithm, specified in the header, dictates the method used to generate the signature, impacting the security of the JWT and its suitability for different applications.\n",
    "\n",
    "- Secret Key: A confidential piece of information shared between parties, the secret key is crucial for generating and verifying the signature, ensuring the JWT's security in the authentication process.\n",
    "\n",
    "### Specifically in the code: \n",
    "Header (JwtHeaderExample):\n",
    "- Creates a JWT header with specified algorithm (\"HS256\") and type (\"JWT\").\n",
    "- Encodes the header using Base64 URL encoding.\n",
    "\n",
    "Payload (JwtPayloadExample):\n",
    "- Defines JWT claims (name, class, exp).\n",
    "- Converts claims to JSON format (placeholder method mapToJson).\n",
    "- Encodes the payload using Base64 URL encoding.\n",
    "\n",
    "Signature (JwtSignatureExample):\n",
    "- Uses a secret key to generate an HMAC SHA-256 signature.\n",
    "- Combines the Base64 URL-encoded header and payload.\n",
    "- Encodes the signature using Base64 URL encoding."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Generated JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VySWQxMjMiLCJpYXQiOjE3MDQ4MjI5NjcsImV4cCI6MTcwNDgyNjU2N30=.77-9V--_vQXvv71pQu-_vUbvv73vv71kD--_ve-_vTxG77-977-9Gwvvv73vv70477-977-9ae-_vWXvv73vv70=\n"
     ]
    }
   ],
   "source": [
    "import java.nio.charset.StandardCharsets;\n",
    "import java.util.Base64;\n",
    "import javax.crypto.Mac;\n",
    "import javax.crypto.spec.SecretKeySpec;\n",
    "\n",
    "public class JwtGenerator {\n",
    "\n",
    "    public static void main(String[] args) {\n",
    "        //secret key for encoding and decoding\n",
    "        String secretKey = \"yourSecretKey\";\n",
    "\n",
    "        //subject (user identifier) and expiration time for the JWT\n",
    "        String subject = \"userId123\";\n",
    "        long expirationTimeMillis = System.currentTimeMillis() + 3600000; // 1 hour expiration\n",
    "\n",
    "        //build the JWT\n",
    "        String jwt = buildJwt(secretKey, subject, expirationTimeMillis);\n",
    "\n",
    "        //print the generated JWT\n",
    "        System.out.println(\"Generated JWT: \" + jwt);\n",
    "    }\n",
    "\n",
    "    //build the JWT with header, payload, and signature\n",
    "    private static String buildJwt(String secretKey, String subject, long expirationTimeMillis) {\n",
    "        //JWT Header\n",
    "        String header = \"{\\\"alg\\\":\\\"HS256\\\",\\\"typ\\\":\\\"JWT\\\"}\";\n",
    "\n",
    "        //JWT Payload (Claims)\n",
    "        String payload = \"{\\\"sub\\\":\\\"\" + subject + \"\\\",\\\"iat\\\":\" + System.currentTimeMillis() / 1000 +\n",
    "                \",\\\"exp\\\":\" + expirationTimeMillis / 1000 + \"}\";\n",
    "\n",
    "        //base64 URL encode the header and payload\n",
    "        String encodedHeader = base64UrlEncode(header);\n",
    "        String encodedPayload = base64UrlEncode(payload);\n",
    "\n",
    "        //combine Base64 URL-encoded header and payload with a period '.'\n",
    "        String dataToSign = encodedHeader + \".\" + encodedPayload;\n",
    "\n",
    "        //sign the data with the secret key to generate the signature\n",
    "        String signature = signData(dataToSign, secretKey);\n",
    "\n",
    "        //combine the data, signature, and return the final JWT\n",
    "        return dataToSign + \".\" + signature;\n",
    "    }\n",
    "\n",
    "    //base64 URL encode the input string\n",
    "    private static String base64UrlEncode(String input) {\n",
    "        return Base64.getUrlEncoder().encodeToString(input.getBytes(StandardCharsets.UTF_8));\n",
    "    }\n",
    "\n",
    "    //sign the data using HMAC SHA-256 with the provided secret key\n",
    "    private static String signData(String data, String secretKey) {\n",
    "        try {\n",
    "            Mac sha256Hmac = Mac.getInstance(\"HmacSHA256\");\n",
    "            SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey.getBytes(StandardCharsets.UTF_8), \"HmacSHA256\");\n",
    "            sha256Hmac.init(secretKeySpec);\n",
    "            byte[] signature = sha256Hmac.doFinal(data.getBytes(StandardCharsets.UTF_8));\n",
    "            return base64UrlEncode(new String(signature, StandardCharsets.UTF_8));\n",
    "        } catch (Exception e) {\n",
    "            throw new RuntimeException(\"Error signing JWT\", e);\n",
    "        }\n",
    "    }\n",
    "}\n",
    "\n",
    "JwtGenerator.main(null);"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<h1> JWT with Spring Boot </h1>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<h2> Big Idea </h2>\n",
    "<img alt=\"JWTProcess\" src=\"{{site.baseurl}}/images/JwtProcess.png\">\n",
    "\n",
    "1. JwtAuthFilter is executed first (validates and checks JWT Tokens)\n",
    "    - Internal check to check if the token is there or not. \n",
    "    - Extracts the subject (username or email)\n",
    "    - If token is missing → 403 error sent\n",
    "    - If token is there:\n",
    "        - Makes a call using the UserDetails Service to fetch user info from the database. Uses the subject extracted to do so\n",
    "        - Response comes back from the database (user either exists or doesn't)\n",
    "        - If the user does not exist → 403 error sent\n",
    "        - If user exists → validate JWT process is started\n",
    "\n",
    "2. Validate JWT Process\n",
    "- Calls the jwt service which takes the user and jwt token as parameters\n",
    "- Token isn't valid → 403 error sent\n",
    "- Token is valid → update the security context holder and set the connected user. User is now authenticated yay!\n",
    "    - Automatically dispatch request → sent to dispatcher servlet → sent to controller → allow all execution user wants to do \n",
    "    - Sends http 200"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Here is a diagram that makes it easier to understand the process tha happens between JWT and the API calls. \n",
    "<img alt=\"JWTApi\" src=\"{{site.baseurl}}/images/JwtAPI.png\">\n",
    "\n",
    "- User posts with their login information\n",
    "- server does authentication to confirm the user\n",
    "- store the user in the memory of the server, send a corresponding ID with a cookie back to the client\n",
    "- Now every time the user sends a request, the cookie with that corresponding ID gets send to the server which verifies the ID and sends back a response.\n",
    "\n",
    "Popcorn Hack: Create your own diagram to help visualize the JWT process\n",
    "\n",
    "![diagram](https://raw.githubusercontent.com/Pitsco/personal/main/images/JWTlessondiagram.png)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<h2> JWT Walkthrough </h2>\n",
    "- Clone this repo and follow along in each JWT file: https://github.com/vivianknee/jwtlessonBackend.git"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<h3> Logic flow </h3>\n",
    "<b>Step 1 (Client - Login Request):</b> The client sends a login request with user credentials (username and password) to the /authenticate endpoint.\n",
    "\n",
    "<b>Step 2 (JwtApiController):</b>\n",
    "- The JwtApiController receives the login request.\n",
    "- It authenticates the user credentials using the AuthenticationManager.\n",
    "- If authentication is successful:\n",
    "Retrieves user details using the PersonDetailsService.\n",
    "Generates a JWT using the JwtTokenUtil.\n",
    "Sends the JWT as an HTTP-only secure cookie in the response.\n",
    "\n",
    "<b>Step 3 (Client - Subsequent Requests):</b>\n",
    "- The client includes the JWT cookie in the headers of subsequent requests.\n",
    "\n",
    "<b>Step 4 (JwtRequestFilter):</b>\n",
    "- For each incoming request, the JwtRequestFilter intercepts the request.\n",
    "- Extracts the JWT from the HTTP request headers or cookies.\n",
    "- Validates the JWT using the JwtTokenUtil.\n",
    "- If the token is valid, sets up authentication using Spring Security's SecurityContextHolder.\n",
    "\n",
    "<b>Step 5 (Spring Security):</b>\n",
    "- Spring Security processes the request with the authenticated user.\n",
    "- The application can now authorize the user based on the roles and permissions associated with the JWT.\n",
    "\n",
    "<b>Step 6 (Error Handling - JwtAuthenticationEntryPoint):</b>\n",
    "- If the JWT is missing, invalid, or expired, and the request requires authentication, the JwtAuthenticationEntryPoint handles the authentication failure.\n",
    "- Responds with an HTTP 401 (Unauthorized) status.\n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Storing JWT\n",
    "There are a few different options for storing a JWT in a JavaScript application:\n",
    "\n",
    "1. Cookies: You can store the JWT in a cookie and send it back to the server with each request. This is a simple and widely-supported option, but it has some limitations. For example, you can’t access cookies from JavaScript on a different domain, and some users may have cookies disabled in their browser settings.\n",
    "\n",
    "2. Local storage: You can store the JWT in the browser’s local storage (localStorage) or session storage (sessionStorage). This option allows you to access the JWT from JavaScript on the same domain, but it is vulnerable to cross-site scripting (XSS) attacks, where an attacker can inject malicious code into your application and steal the JWT from the storage.\n",
    "\n",
    "3. HttpOnly cookie: You can store the JWT in an HttpOnly cookie, which is a cookie that can only be accessed by the server and not by client-side JavaScript. This option provides some protection against XSS attacks, but it is still vulnerable to other types of attacks, such as cross-site request forgery (CSRF)."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Postman \n",
    "1. Trying to access /api/person/ without jwt token stored in Cookies\n",
    "- <img alt=\"nojwt\" src=\"{{site.baseurl}}/images/nojwt.png\">\n",
    "\n",
    "2. Trying to access /api/person/ with a wrong jwt token stored in Cookies\n",
    "- <img alt=\"wrongjwt\" src=\"{{site.baseurl}}/images/wrongjwt.png\">\n",
    "\n",
    "3. Trying to access /api/person/ with a jwt token that does not have the signature\n",
    "- <img alt=\"nosignature\" src=\"{{site.baseurl}}/images/nosignature.png\">\n",
    "\n",
    "4. Accessing /api/person/ with generated jwt token stored in Cookies header\n",
    "- <img alt=\"yes\" src=\"{{site.baseurl}}/images/yes.png\">"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Implementation Approaches and Security Considerations"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "JWTs are signed to ensure they cannot be modified in transit. Signature is a crucial aspect of JWT security.\n",
    "\n",
    "Key Usage\n",
    "- Token Issuance: When the token is issued by the authorization server, it is signed with a key.\n",
    "- Token Reception: When the client receives the token, the signature is validated using the key."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import io.jsonwebtoken.Jwts;\n",
    "import io.jsonwebtoken.Claims;\n",
    "\n",
    "public class TokenReceptionExample {\n",
    "\n",
    "    // Simulate receiving a token from the client\n",
    "    private static String receiveTokenFromClient() {\n",
    "        // In a real scenario, this would be received from the client (e.g., from a request header)\n",
    "        return \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiAiMTIzIiwgImV4cCI6IDE2MjM5NzYzODF9.4X1lC5fU4dV1n9l02LZyGQSy5K-O5fnZM0t6eO-w2Qs\";\n",
    "    }\n",
    "\n",
    "    public static void main(String[] args) {\n",
    "        // Example of Token Reception\n",
    "        String receivedToken = receiveTokenFromClient();\n",
    "        System.out.println(\"Received Token: \" + receivedToken);\n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Symmetric vs. Asymmetric Key Approaches\n",
    "- Symmetric Key: A single secret key is used both to sign and validate the token.\n",
    "- Asymmetric Key: Different keys are used to sign and validate the token, only the authorization server has the ability to sign it."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import io.jsonwebtoken.Claims;\n",
    "import io.jsonwebtoken.ExpiredJwtException;\n",
    "import io.jsonwebtoken.Jws;\n",
    "import io.jsonwebtoken.Jwts;\n",
    "import io.jsonwebtoken.MalformedJwtException;\n",
    "import io.jsonwebtoken.security.Keys;\n",
    "\n",
    "import java.security.Key;\n",
    "\n",
    "public class SymmetricKeyValidationExample {\n",
    "\n",
    "    // Symmetric Key for Token Signing and Validation\n",
    "    private static Key symmetricKey = Keys.secretKeyFor(io.jsonwebtoken.SignatureAlgorithm.HS256);\n",
    "\n",
    "    // Token Validation with Symmetric Key\n",
    "    private static Claims validateTokenSymmetric(String token) {\n",
    "        try {\n",
    "            // Parse and verify the token using the symmetric key and the HS256 algorithm\n",
    "            Jws<Claims> claimsJws = Jwts.parserBuilder().setSigningKey(symmetricKey).build().parseClaimsJws(token);\n",
    "            return claimsJws.getBody();\n",
    "        } catch (ExpiredJwtException e) {\n",
    "            // Handle case where the token has expired\n",
    "            System.out.println(\"Token has expired\");\n",
    "        } catch (MalformedJwtException e) {\n",
    "            // Handle case where the token is invalid (e.g., tampered with)\n",
    "            System.out.println(\"Invalid token\");\n",
    "        }\n",
    "        return null;\n",
    "    }\n",
    "\n",
    "    public static void main(String[] args) {\n",
    "        // Example of Token Validation with Symmetric Key\n",
    "        String receivedToken = receiveTokenFromClient();\n",
    "        Claims validatedClaims = validateTokenSymmetric(receivedToken);\n",
    "        if (validatedClaims != null) {\n",
    "            System.out.println(\"Validated Payload: \" + validatedClaims);\n",
    "        }\n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Additional Security Considerations\n",
    "- Token Scope: limit token access to specific resources or actions\n",
    "- Token Revocation: implement mechanism to revoke token if user's access needs to be taken away\n",
    "- Token Encryption: encrypt token if it contains sensitive information that shouldn't be visible (even if intercepted)\n",
    "- Regular Key Rotation: rotate keys regularly for security and to limit the impact of compromised key"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Hacks\n",
    "1. Implementation \n",
    "- Implement a simple authentication system using JWT with Java. Show how JWT works with postman. Get the request to be authorized. [Link here](https://github.com/Pitsco/personal/issues/1)\n",
    "\n",
    "2. MC Knowledge test (5) \n",
    "    - Which part of the JWT contains the actual data (claims)? \n",
    "        - Header\n",
    "        - **Payload**\n",
    "        - Signature\n",
    "        - Encryption\n",
    "    - What is the purpose of the header in a JWT?\n",
    "        - It contains the signature for the JWT.\n",
    "        - **It identifies the algorithm used to generate the signature.**\n",
    "        - It holds the encrypted data. \n",
    "        - It contains the user's information.\n",
    "    - How are the parts of a JWT (header, payload, and signature) separated?\n",
    "        - Comma\n",
    "        - **Period**\n",
    "        - Colon\n",
    "        - Semicolon\n",
    "    - Which algorithm is commonly used for JWT signatures?\n",
    "        - **HMAC (Hash-based Message Authentication Code)**\n",
    "        - RSA (Rivest-Shamir-Adleman)\n",
    "        - AES (Advanced Encryption Standard)\n",
    "        - MD5 (Message Digest Algorithm 5)\n",
    "    - How are JWTs commonly transmitted?\n",
    "        - Only via HTTP headers\n",
    "        - Only as query parameters in the URL\n",
    "        - In the request body as JSON\n",
    "        - **Any of the above, depending on the application**"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Java",
   "language": "java",
   "name": "java"
  },
  "language_info": {
   "codemirror_mode": "java",
   "file_extension": ".jshell",
   "mimetype": "text/x-java-source",
   "name": "java",
   "pygments_lexer": "java",
   "version": "17.0.9+9-Ubuntu-122.04"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}