Is it possible to prevent JWT Hijacking?

tuaris

tuaris

I'm trying to design a system where there are as little moving parts as possible. For example, JWT are a great option to avoid having to validate authorization and entitlements through an intermediary. The JWT contains everything you need and has a way to ensures it wasn't tampered with.

However it has one flaw (in my opinion), hijacking. Is there a way have the holder prove the JWT indeed belongs to them, in such a way that it still doesn't require an intermediary?

Consider this analogy, a JWT is like a access card/badge. In order to enter through a door to a high security area, you must swipe your badge and perform a biometrics scan. In order to pass, the encoded data on the badge must meet these conditions:
  1. The area you are entering is permitted by the access level of your badge
  2. Your biometrics scan result matches with the biometrics data on your badge
  3. Your badge was issued by an recognized entity
  4. The information on your badge has not been tampered with.
JWT is basically all that, except for #2. Would it be possible to replicate some type of proof of ownership with JWT? Not necessarily through biometrics.

BTW, by "intermediary" I mean not having to call/contact an external service/API to validate credentials.
 
I don't follow. A JWT is just a JSON blob signed with a private key. You can verify this signature with the public key. So long as you trust whomever published the public key, you can trust the JWT.
 
If you used a Client SSL Certificate backed by a device like a CAC, Apple Secure Enclave or other FIDO2 device, you'd get what you're looking for.
 
You must log in or register to reply here.
Back
Top