-
Notifications
You must be signed in to change notification settings - Fork 952
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement 'jti' parameter for jwt to prevent replay attacks #265
Comments
Sounds reasonable. Is this something you want to submit a PR for? |
@bshaffer I would love to submit a PR, but would like some input on how we should expire the However, the question is how unique the However, we can also make it a bit "smarter" by linking the Once we have decided how to deal with that, implementation should be quite trivial. Cheers 😄 |
@bshaffer Let's reopen this for some further discussion as I think I would like to push an update to this. Unfortunately, the spec doesn't give any guidance on how the JTIs should be generated:
So, the following approaches for generating a nonce may be considered valid:
The above would cause collisions if 2 clients use the same scheme for generating the jtis. I would like to modify the storage implementation to the following: public function getJti($client_id, $jti, $jwt) public function setJti($client_id, $jti, $jwt); Instead of passing the jwt parameters to the storage implementations, we are passing the This means that we could hopefully steer implementations to do the following:
I recommend something like this for generating the $random_number = ... //generate using openssl_random_pseudo_bytes
$jti = hash('sha256', serialize($jwt) . $random_number); In conclusion:
Would love to hear your feedback on this! 😄 |
@F21 i'm just answering because i found it through google and someone else might find it: |
The 'jti' parameter in a JWT is a nonce to prevent replay attacks. This is currently optional in the spec and is not currently implemented in the library.
We should add support for checking the jti to see if it has been used. If so, the request should be denied.
The text was updated successfully, but these errors were encountered: