存储和使用JWT和密钥

Question

I have a login route for my app. I use jwt tokens to protect routes, but I have trouble to understand fully usage of secret key .

I tought I need to use secret key to verify jwt . Whenever user logs in, I send JWT Token and Secret key to user. JWT is stored in local storage (phone or app storage)

What should I about secret key? Should I both store to local and database?

Login Route

api.post('/api/login', (req, res) => {

var secretKey;

require('crypto').randomBytes(48, function(err, buffer) {
    secretKey = buffer.toString('hex');

    //Create JWT and Secret Key
    jwt.sign({user}, secretKey, {expiresIn: '30s'}, (err, token) => {
        res.json({
            access_token : token,
            secret_key : secretKey

        });
    });


});

});

Response After Login

{
"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjp7ImlkIjoxLCJ1c2VybmFtZSI6ImV4YW1wbGV1c2VyIiwiZW1haWwiOiJleGFtcGxlQGdtYWlsLmNvbSJ9LCJpYXQiOjE1NTExMTE1ODAsImV4cCI6MTU1MTExMTYxMH0.aSTVC-HcEdrH1KBNtuD_MoLZ8DWnSiM6bCqO4EgJ5zM",
"secret_key": "2e6a98abb5b23339ad14601d3bedc1d23847498cb18daf8cfc98c2a2095ec8f47d80053f6d4e22b8f6419407ac3083dc"}

Answer 1

Your secret key should never be given to anyone else. You need to keep this key a secret. You can use the secret key to sign and issue tokens. It can also be used to validate tokens, but using your secret key to validate tokens is generally a bad idea because you then need to send the secret key to the service that is validating the token, which goes against the advice in my first two sentences.

If your secret key is asymmetrically signed, you can generate a public key based on the secret (private) key in the form of what's called a JSON Web Key ( read about JWKs here ). That public key can then be given to anyone in the universe and the public key can be used to verify the JWT only; the public key cannot be used to sign new tokens.

This means that you should only store the secret key in one location and that should be on your auth server that signs and issues tokens. Read more about asymmetric key signing here

Answer 2

You should never send back to the client the secret key. You have to store the secret key in your server. You need it to sign and to verify jwt tokens.

This should be the flow:

• User login
• Server generates JWT (using the secret key) and send it (the jwt only) to the client
• The client saves the JWT in the local storage or where you want, and send it as an header to the server when he needs to do authenticated http calls.
• When the server recieves an authenticated call, he have to verify the JWT (using the same secret used for signin) to authenticate the call.

Read more about JWT at https://jwt.io/