使用Node.js在JWT中存储秘密信息-Express后端

Question

I am developing an Angular web app that communicates to its back-end via RESTful API. Currently I am using JWTs to store the state (current user ID, etc). I use jsonwebtoken and passport-jwt packages to implement the JWT with my Node.js-Express application.

Sometimes I might need to store in the state some information (for example, a secret encryption key) that is relevant to the session, but that should not be known by the user.

Since the JWT payload is signed but not encrypted, its contents are plainly visible to anyone who cares to decode it, it is not appropriate to store secret content directly in the payload. While I could implement some kind of self-made encryption either of the whole JWT string or just the secret variable value in the payload, I am looking for the "right" or "traditional" way to handle this.

Answer 1

The best way would be to store it only on the back end in some kind of persistent storage preferable hashed.

If that isn't possible then you can store in the JWT but you would need to encrypt the data before putting it in there.

Bcrypt is probably the easiest solution that is still secure is https://www.npmjs.com/package/bcryptjs . Be aware that the more secure you want it the slower the encryption will be.