bk99.de entertain the web since 1997

bk99.de
RFC · AuthenticationStandard explained

RFC 7519: JWT: Signed claims in JSON format

Summary

RFC 7519 defines compact JSON Web Tokens for transferable claims with signature or encryption. Self-contained tokens reduce lookups and make immediate revocation harder. Flexible cryptography requires strict checking of algorithms and claims.

Ideas

  • Claims describe subject, issuer, audience and validity.
  • JWS signs tokens, JWE encrypts them.
  • The compact encoding fits into HTTP headers and URLs.

Remarks

  • RFC 7519 has the status “Proposed Standard”; current errata and successor documents should also be checked.

Recommendations

  • Allow only explicitly configured algorithms.
  • Check issuer, audience, expiry and signature completely.

References

Read the RFC at the RFC Editor

Search the Web Archive

RFC · 2025

RFC 9700: Running OAuth 2.0 securely

RFC 9700 brings together current security practices for OAuth 2.0 and rejects risky historical patterns. A flexible authorisation framework needs secure profiles and defaults. Best practices can later explicitly replace early standard options.

Hostblogger · 2021

FIDO U2F as a second factor in the customer menu

Manuel Schmitt adds FIDO U2F to the customer menu and thereby supports physical as well as virtual security keys. FIDO U2F was offered in addition to SMS and OATH-TOTP. The web hosting management itself had not yet been switched over at the time of publication.

Hackaday · 2017

OAuth2 for Gmail on Linux and ESP8266

Hackaday explains token-based Gmail login so that scripts and microcontrollers can send email without a stored account password. Gmail documents its OAuth2 interface. The approach runs on Linux and the ESP8266.