Behind-the-Wall JWT Authentication for Web Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web-based applications face significant authentication overhead when using session tokens, leading to unmanageable network traffic, and JWTs compromise security by exposing sensitive information when stored on uncontrolled devices.
Innovation Solution
Implementing behind-the-wall JWT authentication, where JWTs are generated and remain within the private network, using a hashed session token to minimize exposure and reduce authentication overhead by caching limited-duration JWTs, and employing session tokens for public network interactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If session tokens are used for authentication in web-based applications, then security is enforced, but authentication overhead and network traffic become unmanageable
Solution Approach 1:
The authentication system is segmented into two parts: session tokens remain on the public network for client identification, while JWTs are generated within the private network for service authentication. This segmentation allows each token type to serve its specific purpose without the overhead of continuous authentication validation across the entire system.
Solution Approach 2:
JWTs act as an intermediary mechanism between the public network (session tokens) and private network services. The JWT contains embedded authentication information that allows services to verify user identity without contacting the authentication service, reducing network traffic and authentication overhead.
2Productivity
If JWTs are used for authentication, then authentication overhead is reduced, but security is compromised by exposing sensitive information on uncontrolled devices
Solution Approach 1:
Sensitive authentication information is extracted from the public-facing session token and placed into a JWT that is generated within the private network. The session token itself remains a simple identifier without embedded sensitive data, while the JWT (which never leaves the private network) contains the necessary authentication claims.
Solution Approach 2:
Different parts of the system use different authentication mechanisms appropriate to their security requirements: session tokens on the public network (simpler, less sensitive information) and JWTs within the private network (detailed authentication information). This local differentiation optimizes both security and efficiency for each context.
3Reliability
If multiple services validate session tokens, then security is maintained across services, but network traffic increases significantly
Solution Approach 1:
Authentication information is preliminarily packaged into the JWT during the initial authentication process. Subsequent services can validate this pre-packaged information locally without needing to contact the authentication service, eliminating repeated network validation traffic while maintaining security.
Data Source
AI summary
Techniques are provided for using tokenization in conjunction with “behind-the-wall” JWT authentication. “Behind-the-wall” JWT authentication refers to JWT authentication techniques in which the JWT stays exclusively within the private network that is controlled by the web application provider. Because the JWT stays within the private network, the security risk posed by posting the JWT in a client cookie is avoided. However, because JWT is used behind-the-wall to authenticate a user with the services requested by the user, the authentication-related overhead is significantly reduced.