Issuing and verifying credentials.
WHAT A TOKEN REPRESENTS
An assertion that someone has authenticated.
WHAT TO VERIFY ON EVERY REQUEST
The signature The expiry The intended audience and issuer
WHY THE SIGNATURE SPECIFICALLY
An unverified token can be created by anyone.
WHAT TO NEVER DO
Accept a token specifying its own verification method Trust claims without verifying the signature Use a weak or shared signing secret
WHAT TO SET
Short lifetimes for access tokens A separate refresh mechanism with longer life
WHY SHORT
A stolen token is usable until it expires, and there is frequently no revocation.
WHAT TO PLAN FOR
Revocation, which self-contained tokens do not naturally support.
WHAT THE APPROACHES ARE
A short expiry, limiting exposure A revocation list, checked on each request Server-side sessions instead
WHAT NOT TO PUT IN A TOKEN
Anything sensitive.
WHY
The contents are readable by anyone holding it.
WHERE TO STORE TOKENS IN A BROWSER
A cookie with appropriate flags, rather than accessible storage.
WHAT TO ROTATE
Signing keys, with a period supporting both.
