4

When you authenticate with an OIDC provider you get back an id token and if you specified scopes for an API you get back an access token so that client applications can make requests to protected resources on the end user's behalf. Typically the access token is also a JWT.

But what is to stop someone from spoofing one of these access tokens, and creating one and passing it to an API? I understand there are safeguards to prevent modification because the signature will be different than what any validation logic is expecting, but what if a malicious user created a brand new one manually? Especially because these tokens can be validated 'in place' by any API that requires an access token (not all API's use the introspection endpoint... especially with a JWT). I do understand there is metadata around the signing keys for JWT's from OpenID Connect providers and that it is available in the OIDC discovery document. For example, here is Google's JWK metadata. Given that you have signing information publicly available, and JWT access token's can be validated without any requests to the OIDC provider, how are JWT's secure? What is preventing a person from creating one and passing it as a bearer token to an API that requires an access token?

Rob L
  • 3,073
  • 6
  • 31
  • 61

1 Answers1

7

But what is to stop someone from spoofing one of these access tokens, and creating one and passing it to an API?

Spoofing and reconstruction of signature is nearly impossible without the private key (assuming you are using asymmetric signing algorithm like RS256) that used for signing the original JWT.

The JWK information available via OIDC discovery document only contains the public key.

Also Use HTTPS for authorization / token exchange to avoid token sniffing.

Karthik
  • 3,075
  • 3
  • 31
  • 61
  • So in order to reconstruct a JWT one would need to know the corresponding private key? – Rob L Nov 01 '17 at 10:01
  • Yes. That is right. The signature part of the JWT can't be reconstructed without the private key and that is why the signature plays a major role in token communication. – Karthik Nov 01 '17 at 20:32
  • Who holds the private key? If I was using Azure AD to authenticate a user for example, would Microsoft hold the private key that signs all tokens returned? – Dan Harris Jun 30 '22 at 15:27