The Parts of JWT Security Nobody Talks About | Philippe De Ryck, Google Developer Expert

Join the "Full Stack Developers Israel" future meetups @ www.meetup.com/full-stack-deve...
JSON Web Tokens (JWT) have become the de facto standard to transfer application claims between the client and the server. By design, they incorporate the use of signatures to ensure the integrity of the data. However, merely signing the data alone is not enough to guarantee security.
In this talk, we zoom into the security properties of JWTs. After introducing the different signature schemes, we dive into the hard parts nobody talks about. How do you manage and identify the keys used for the signature? How do you handle key rotation? And what about encrypting JWTs? This talk answers all these questions. You will walk away with a set of best practices for adequately securing JWTs.
Philippe De Ryck is the founder of Pragmatic Web Security, where he travels the world to train developers on web security and security engineering. He holds a Ph.D. in web security from KU Leuven. Google recognizes Philippe as a Google Developer Expert for his knowledge of web security and security in Angular applications.
video production: מדיה'לה | Mediale

[@hnasr]

My god I learn so much from this talk! Loads of information and the presenter is knowledgeable!

[@gjuoun]

Unbelievable! I followed after watched your JWT crash course!

[@prashanttiwari120]

Hi Hussie, great to see your comment here

[@philippec4448]

You here, how am I not surprised !? By the way I really enjoy your videos, I’ve learned so much from them. Keep up the good work !

[@hectormejia499]

Holy crap, JWTs are insanely complex, very good talk! Also scares me that this is the defacto method for "simple and secure" authentication in most APIs.

[@Deebool]

Very clear and detailed yet concise. Thanks you very much!

[@CodeDoctorJet]

Excellent preso. As AppSec professionals we need these kinds of prescriptive information for our developers. I'll definitely be sharing the cheat sheet and recommending more use of things like key IDs rather than just basic jwt sharing. Good stuff.

[@dmytroshchotkin2939]

Thanks, SIr. It's a very good explanation! Indeed, very clear!

[@Pownas89]

Still a Really good talk where I’ve learned a lot and got a lot of the info confirmed from what others haven’t explained fully. Thanks for a good informative video! 😊

[@dsebastien]

Great presentation, thanks for sharing!

[@robertodiana5821]

the title maintains the promises

[@manojlasantha8499]

Great talk ! I learnt a lot from the talk.

[@philippec4448]

Awesome video ! So much to take from it. Thx for sharing it.

[@amitparks]

One of the best on JWT , JWS...

[@MosheEshel]

Excellent talk, I learned a lot of new things.

[@stokitko]

Thanks, you refined a lot for me. Guess what, I made an error when during validation of JWT doesn't checked an issuer with expected. It's funny because I had a hesitation to check it but was too busy by implementing sig verification. Thank you again, you saved billions (I hope) of my future users :)

[@ILyaCyclone]

Superb talk, sir!

[@KunalMukherjee3701]

Excellent power packed talk

[@tommasoborgato]

Great talk .... learned a lot of new stuff

[@HenrryPires]

Thanks, amazing talk

[@liferajib]

Best talk on JWT

[@codefarm0]

Super awesome. Tons of cool information. Thanks :)

[@Tidaltwist]

It'd have been helpful if there were timestamps for each part. But great talk though.

[@ims-w6s]

Really good talk on JWTs. Really interesting topics. But why the questions weren't added to the video?? Anyway, great!

[@scottsmyth3251]

super helpful thanks

[@javadhosseini7524]

thanks for your great video. I have a question. Is it good to store a jwk into a json file?

[@philippederyck2572]

Sure, it all depends on how that JWK is used. OpenID Discovery points to a JSON file containing the identity provider's keys ...

[@metalbroga]

i have a question that is related to “renewing” jwt, like those apps that never logs you out (like Facebook, instagram)?

[@Deebool]

I wonder about that part too (and security issues that goes along) !

[@Rheenen]

to renew an accesstoken, you send the expired accesstoken + refreshtoken, validate, and send back a new accesstoken if validation was ok. If not, then don't send back new access token.

[@metalbroga]

@@Rheenen Thanks for the clarification

[@Cdswjp]

Is symmetric signing ever preferred over asymmetric signing?

[@j-tech9156]

Got a lot

[@SM-ok3sz]

Good talk but holy crap is that pointing device annoying.

[@mr.RAND5584]

it is like md5 can be decoded public in their website jwt; just put the token their and it will give information;

[@alvis7574]

JWT is basically a digital envelope encrypted with some symmetric encryption algorithm. Could it secure your payload? Maybe. Could that be a problem for a hacker? Nope.