Stateless JWT Authentication via Segmented Cookie Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing JSON Web Token (JWT) authentication methods face limitations when large payloads exceed cookie size limits, leading to incomplete authentication and vulnerability to attacks like XSS and CSRF.
Innovation Solution
Generating JWT components at a server, storing the JWT header and signature in an HTTP-only secure cookie, and the payload as an encrypted access token, allowing clients to reconstruct and verify JWTs during subsequent requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the JWT payload includes comprehensive user information (users, roles, groups), then the authentication information becomes complete and robust, but the JWT size exceeds the cookie capacity
Solution Approach 1:
The JWT authentication data is segmented into two parts: essential authentication data (header and signature) is placed in the cookie, while the large payload containing detailed user information (users, roles, groups) is stored separately in the HTTP response body. This segmentation allows the cookie to remain within size limits while the complete authentication information is still transmitted to the client.
2Ease of operation
If a regular cookie is used to store JWT, then the authentication data is easily accessible, but the system becomes vulnerable to XSS and CSRF attacks
Solution Approach 1:
The patent introduces an intermediary mechanism by placing the authentication data in an HTTP-only cookie, which acts as a secure mediator between the server and client. This cookie cannot be accessed by JavaScript, preventing XSS attacks, while still being automatically included in HTTP requests for CSRF protection. The authentication flow continues seamlessly through this secure intermediary channel.
3Reliability
If stateful authentication is used to maintain security, then authentication is secure, but the system cannot communicate with multiple different server instances
Solution Approach 1:
The authentication token is made self-contained and stateless by including all necessary authentication information (header, payload with user details, and signature) within the JWT structure itself. This allows any server instance to independently verify the token's authenticity through cryptographic validation without needing to query a central authentication service or maintain session state, enabling seamless communication across multiple server instances.
Data Source
AI summary
Systems and methods for secure stateless client-server communication. User credentials in a client authorization request are authenticated and used to generate a JSON web token (JWT). The JWT header and signature are encrypted and included in an HTTP-only cookie. The JWT payload is encrypted and sent to the client in a response body along with the HTTP-only cookie. Each subsequent client request includes the cookie and has the encrypted JWT payload in the request header. Upon receiving the request, the server decrypts the encrypted JWT payload from the header and decrypts the encrypted JWT header and signature from the cookie, then reconstructs the JWT from the JWT header, payload and signature. The server validates the JWT and, if valid, processes the request according to authorizations in the JWT payload.