A Child’s Garden of Inter-Service Authentication Schemes
I don&#x27;t understand the condemnation of JWTs, this article doesn&#x27;t seem to explain the condemnation other than saying that &quot;It is extraordinarily easy to screw up JWT.&quot; and not to use them.<p>We use JWTs to provide SSO authentication functionality to partners who wish to take on the responsibility for authenticating their users. I still feel like JWT was the correct choice but I&#x27;d really like to know what alluded potential pit falls are.<p>They provide us with the public key of a asymmetric key pair and we provide them with a key ID to use to identify this key a pair. On our side we associate their key ID(s) with the users they are allowed to authenticate.<p>When they wish to authenticate a user, they generate a JWT with a user identifier, the client IP address, the Key ID , and the &quot;issued at time&quot;. This is then signed using their private key associated with the Key ID. They then provide this to to user&#x27;s client who then send it us.<p>We then verify the recency of the JWT, that the JWT is indeed signed by the private key associated with the key id provided, that the IP address matches the client and that the key ID is valid for authenticating the user associated with the user identifier. If all this checks out, we can create a session for the client (using the standard cookie bearer token model).<p>The reasons we picked JWT are:<p>1) We aren&#x27;t responsible for securing their secret(s) (since we never know them) and they can easily send our their public keys to us via less secure channels. If we get a correctly signed JWT, this proves that either the partner approves the authentication or that they have lost control of their private key (in either case, the responsibility is theirs since we have no ability to generate a JWT signed by their private key). This seems like a big improvement over using a shared secret.<p>2) There are existing libraries for most languages to generate and sign a JWT when provided with a few parameters, this decreases the likely hood that our partners will try to roll their own buggy authentication implementation.<p>Aside from the issue of trusting our partners not to expose their private key, I&#x27;m not sure what the foot-guns are here? (although I am admittedly not an expert)