How to secure JWT token ?

@Deepak: I posted based on my experiences in solutioning. 

but when I searched for it, here is what I get: 

to read more about authentication techniques

Mitigation techniques on user authentication and session best practices - https://dev.to/guillerbr/authentication-cookies-http-http-only-jwt-reactjs-context-api-and-node-on-backend-industry-structure-3f8e

to know how to do

How to secure JWTs - https://dev.to/petrussola/today-s-rabbit-hole-jwts-in-httponly-cookies-csrf-tokens-secrets-more-1jbp

 Also read thru the references in each blog

Thanks

Swesh

Hello Deepak,

There are a few points to keep in mind while using a JWT token to keep it secure.

Securely store JWTs in a cookie

You should always store JWTs inside an httpOnly cookie. This is a special kind of cookie that’s only sent in HTTP requests to the server. It’s never accessible (both for reading or writing) from JavaScript running in the browser.

Reference Link:

https://blog.logrocket.com/jwt-authentication-best-practices/

Refresh tokens

Refresh token does not grant access to the API but can be used to request a new access token. After 10 minutes of usage, a few seconds before the user's session expires, we make an API call in the background to the API, sending the refresh token.

Reference Link

https://katifrantz.com/the-ultimate-guide-to-jwt-server-side-authentication-with-refresh-tokens

Thanks

As Swesh said, it is one of the key points of designing applications, where the architect plays a key role. 

Kindly go throw the below links and scenario to avoid this and let me know if you need any more info

https://www.websecuritylens.org/common-jwt-implementation-mistakes-and-how-to-exploit-them/  

A refresh token with a blacklist 

Token rotation concept on daily basis.

Keep Token generator or validator service in private secure network

@Swesh, can you please give some example or any article on this?

Reference : https://www.c-sharpcorner.com/article/jwt-token-authentication-using-the-net-core-6-web-api/

Is a very good question! This is where the architect of that application should focus on! 

You should see, what are all the threat posted to this application like for eg., is this application available only to a private network group of users or general public. What is the strategy of the access token on the life cycle of persona.

Some of the preventions are

1. Use HTTPS only authentication for the tokens

2. Use session identity in the payload (while forming the JWT).

3. Use HTTPOnly method so that the tokens are valid for web application only(JS applications cannot use it anymore) and if the session changes then the token may not valid anymore.

4. Have a revocation list based on the strategy mentioned above.

Thanks

Swesh

https://www.c-sharpcorner.com/article/how-to-implement-jwt-authentication-in-web-api-using-net-6-0-asp-net-core/