What do you need to know about user session security?
To keep tokens safe, a system architect should not only prevent tokens from being stolen but, as a fail-safe, also ensure that should token theft occur, the system is able to detect it as quickly as possible. Detection is an important concept to consider and will be explored in the next section.
Are there security issues with user authentication tokens?
While using the latest technology might be strongly recommended, not understanding how the technology works, the possible security issues, and the basics of secure development practices is also a big problem. Authentication and user session management are particularly vulnerable areas.
How can I revoke a user session token?
However, one can revoke all tokens by changing the signing key. These are random strings which act as pointers to information that is held only by the system that issues them. These require a database/cache lookup each time they are used. A single token can easily be revoked on demand.
What do you need to know about session management?
Session management, for the purpose of this article, is about how auth tokens are handled, stored and changed during an active session — whether it be for OAuth flows, or for server-client session flows. Why is session security important?
What happens when an auth token is not valid?
When the access token expires, the client uses the refresh token to refresh the access token. During the refresh token check, the server checks a small blacklist of user ids – if found reject the refresh request. When a client doesn’t have a valid (not expired) refresh or auth token the user must log back in, as all other requests will be rejected.
Why do people use JWTs as session tokens?
JWTs give people an easy way to pass data between each other, while at the same time verifying who created the data in the first place. So, going back to our previous example, if I received 1,000,000 different JWTs that contained a Venmo address, I’d easily be able to tell which one actually came from you.