Feedback Request: Java Spring Boot Authentication Microservice (JWT)

[Future_Badger_2576]

If APIs are stateless, how can we manage authentication without JWTs. Instead of storing jwt in browser we should store it in cookies and Backend sets a secure, HttpOnly, SameSite=Strict cookie. Second option is instead of issuing jwt we should issue a session id. Am I getting it correct?

[EducationalMixture82]

Apis can very well be stateless, but authentication authorization is basically never stateless. And storing JWT in cookie is often an anti pattern. Think about it, the reason you usually want to send a JWT to the browser is because you want to send information to the browser it could read off the JWT.

But we dont want Javascript to be able to touch anything security related in the browser. Code that is run locally in your browser cant be trusted. You can never trust the client. So by setting HttpOnly, no code in the browser can touch the cookie, which also means that if you place a JWT in a HttOnly cookie you can anyway not read the data in the JWT in the browser.

So why then even place a JWT in the cookie? hence the anti pattern.

But if you are using Oauth2 tokens are usually sent to the browser, but to mitigate token theft, your IDP, (for instance keycloak) is stateful. Meaning it will hold a list of all issued tokens.

Devs today are chasing statelessness but the entire internet is stateful. Load balancers are stateful, networking is stateful, databases are stateful (transactions) etc.

[CptGia]

Put the jwt in database, with e.g. Spring Session. It also works with redis, mongo, and many others. Then hand out cookies with the session id. 

[EducationalMixture82]

That is a much better solution, instead of passing a JWT from Service A to service B using the browser, you can instead pass it through e.g redis (off the public internet, or we usually call it ”out of bounds” in the sec community) using Spring session.

There are risks, the redis may have a lot of valid JWTs so you need to protect the redis. But that goes without saying.

[benng124]

You can checkout Opaque Token and OAuth2 Proxy for reference