Should I be validating JWT on my back-end with or without secret?

[kkrp1]

I’m using the express-oauth2-jwt-bearer Node.js package on my back end to validate an Auth0 JWT passed to it from the (separate, SPA) front-end, like so:

const { auth } = require('express-oauth2-jwt-bearer');
auth({
	audience: process.env.AUTH0_API_AUDIENCE,
	issuerBaseURL: process.env.AUTH0_API_DOMAIN
});

This is how the package’s docs suggest you do it. However, the same docs then give a further example, for tokens signed with " symmetric algorithms", where a secret is used in the validation, like so:

  auth({
    issuer: 'https://YOUR_ISSUER_DOMAIN',
    audience: 'https://my-api.com',
    secret: 'YOUR SECRET',
    tokenSigningAlg: 'HS256',
  })

So do I need the first approach, which doesn’t use secret, or the second, which does? I’m quite new to JWT. I just want to know that I’m doing this securely.

Thank you!

[tyf]

Hey @kkrp1 !

@kkrp1

So do I need the first approach, which doesn’t use secret, or the second, which does? I’m quite new to JWT. I just want to know that I’m doing this securely.

Great question! It depends on which algorithm you’re using to sign tokens (you can check in your application settings → advanced → oauth tab as well as in your API settings)- Typically this will be RS256 which is asymmetric, won’t include using a secret, and is generally considered more secure. HS256 is symmetric and requires a secret. Some further resources on this topic:

RS256 vs HS256 JWT signing algorithms

Question: What’s the difference between RS256 and HS256 JWT signing algorithms? TLDR; RS256 and HS256 are algorithms used for signing a JWT. RS256 is an asymmetric algorithm, meaning it uses a public and private key pair. HS256 is a symmetric algorithm, meaning it uses a shared secret. Auth0 uses RS256 as the default signing algorithm in JWTs. We recommend that you use RS256 instead of HS256 for several reasons. Answer RS256 and HS256 are two algorithms used for signing a JSON Web Token …

RS256 vs HS256 What's the difference?

Hope this helps to clarify!

[kkrp1]

Aha yes it is set to RS256 (actually, it won’t let me change this, even if I wanted to) so I’m all good and secure, then, by the sounds of it.

I’m still getting my head around JWTs! Trying to understand how it can be secure, if secrets aren’t involved. Just to double-double-check, this is what I’m doing:

Front-end, using JS SDK:

const auth0Client = await createAuth0Client({
	domain: '<my-auth0-domain>',
	clientId: '<my-auth0-client>',
	... //bunch of other config here
})

Back-end, to validate the JWT passed to it by the front-end:

const { auth } = require('express-oauth2-jwt-bearer');
module.exports.validateJwt = auth({
	audience: '<auth0-api-identifier>',
	issuerBaseURL: '<auth0-domain>'
});

And everything works, I’m just a little alarmed at how there’s no secrets involved! But everything I read (not least on this forum) suggests I’m on the right lines?

Thanks for the continued help!

[tyf]

Hey @kkrp1 thanks for following up here and happy to help!

Everything looks good to me! Aside from validating the tokens, the express-oauth2-jwt-bearer library provides some helpful functions for more granular authorization as outlined here:

node-oauth2-jwt-bearer/packages/express-oauth2-jwt-bearer at main ·... - API Reference

Cheers!

[kkrp1]

Thanks for this - I just had a read of it. I notice there’s a method for checking scope. Would you mind briefly explaining how this might work with/relate to Auth0? Right now I’m merely validating the JWT, as shown, and I’m handling all permissions app-side i.e. I have a custom, proprietary permissions system that I’m managing outside of Auth0. With this in mind, would I be right in thinking I don’t really need to get involved in Auth0-side scopes and roles (not currently sure of the difference)?

[tyf]

Hey @kkrp1 no problem!

@kkrp1

With this in mind, would I be right in thinking I don’t really need to get involved in Auth0-side scopes and roles (not currently sure of the difference)?

If you’re already handling this on your own then you probably don’t need to worry about the other functions provided for checking scopes, claims, etc. They exist for more granular authorization beyond just checking to make sure the access token is valid - For example, you might check to make sure a user has a specific scope, claim, role, etc. before they are able to access a given endpoint. Some examples here:

auth0/node-oauth2-jwt-bearer/blob/main/packages/express-oauth2-jwt-bearer/EXAMPLES.md