JSON Web Tokens

Can everybody hear me? Is it good? Cool. Thank you. So I'm gonna be talking to you today about JWT or how it's said to actually be pronounced JOT. Or just JSON web tokens. Uh my name is Jose Padilla. I am from Puerto Rico, down the Caribbean. We're where we have beaches just like this and it's summer all year long. Um so if you ever get too cold in winter, you're filled You feel free to come down. I work, I'm co-founder and CDO at Blimp. We do Django, Amber. js, Backbone. js consulting for all kinds of clients. Um we also have a few products of our own mostly around uh team collaboration. Uh you can check them out at blimp. io. I'm also

uh collaborate and have a couple of open source projects of my own that you can find on GitHub. That's my username right there. I also tend to blog about startups and tech related experiments of my own whenever I get the chance in my blog right there. Why JSON Web Tokens? Um JSON Web Tokens actually provide us a way to simply send information whose contents can be verified, to be trusted, and there are a number of scenarios where they actually come in handy. Some that I find useful for my use cases are single sign-on where you want to separate authentication uh server that you can send user information in a trusted

way. Also, action links. Um, if you're running any kind of service that uses email communication method, and you have users, you've probably implemented uh reset your password workflow. Where the user receives an email, they click on a link that redirects them to a form, and then they enter their password, right? Um these link usually contain a token that identifies their that user, right? So in my case, I've always tend to generate these tokens in a myriad of different ways. The cool thing about JWT is that it's a standard that works well for URLs. Anytime that you need to communicate a small payload of information between two sources, like via webhooks, uh, this will allow you to actually validate the payload while ensuring its integrity.

Uh in other ways. In other words, uh you can uh make sure that token has not been tampered with. And now my favorite, token-based authentication. We all know that there are two most common ways of implementing server-side authentication for a client-side app. Uh you know, a JavaScript-heavy client-side app and an API. The traditional one is cookie-based authentication, where you have a server-side cookie that authenticates the user on every request. And then there's the more uh the most modern way, let's say, uh, which is token-based authentication, which relies on a sign token that is sent uh to the server on each request to authenticate the user.

Some of the benefits that I actually see for using a token-based approach for authentication are um when you're using cookies and cross are in your requests. Uh they those two don't usually play uh nicely along. Um but when you have token-based uh authentication, you're allowed to make ages calls to any server. on any domain because you're only using HTTP headers. The other cool thing is that you don't need to keep a session store. When you're using cookies, you usually have a database. Uh where you have your sessions or you have uh you know, Mongo or Redis or Memcache uh as a session store. This also allows you to serve all your static content, your JavaScript, your HTML, your images, your CSS, uh right

from a CDN. And just have your server be a REST API that only serves, you know, the data content in like, say, JSON. You also don't need to protect against cross-site request forgery attacks. Um since you're not using cookies, you can just scratch those types of attacks of It also simplifies mobile native applications that require authentication when you're when you're using uh like iOS or Android. And you're building mobile apps for that, you usually have to take care of uh this thing's called cookie containers, uh, which in my experience have been pretty annoying to work with. Um it's also very great for authenticating WebSockets.

Um when you're when you have a WebSockets application, application that uses WebSockets, you have to you know authenticate the user via HTTP but then you have to make sure you're authenticating the WebSockets uh connection as well. So what is Data Web Tokens? As defined by the IETF, the Internet Engineering Task Force, is a compact URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is digitally designed using JSON Web Signature. The cool thing about this standard is that it's Used by companies like Google, Microsoft, Firebase, Senddesk, and by applications like OpenID

Connect and Mozilla Persona. But JWT is part of a bigger standard call. I don't know how to pronounce this, I'm gonna pronounce how I pronounce my name, Jose. It's we have nothing to do with this. Uh it's actually call JavaScript object signing and encryption. Uh the IETF Jose Working Group is actively standardizing specs for the purpose of adding message security to JSON. So we have things like JWA or JSON Web Algorithms, which registers cryptographic algorithms and identifiers that are to be used with the following specifications. like JDLK or JSON WebKy, which is a JSON data structure that represents cryptographic

a cryptographic key. And then we have JWT, or JSON Web Token, like I already said, that is a compact URL-safe means of representing a claim to be transferred between two parties. These claims can ar can be digitally signed and or encrypted. We have a JWS or JSON web signature. Which represent content secure with a digital signature using JSON-based data structures. This signature prevents tampering of your payload. And used with HTTPS prevents man-in-the-middle attacks. But if your payload actually contains sensitive information about the user, like password or any personally

identify information uh you should and need to actually encrypt them using JWE or JSON Web Encryption which represents encrypted content using JSON-based data structure. So basically if you want to encrypt JSON data um so that only the Nintendo receiver actually Can read the payload, can read the data. This specification will actually tell you how to do it. But today it's all about data looting. And how does it actually work? Well, there's the internet draft that was authored by Michael Jones from Microsoft. That's around about 30-33 pages.

Um it contains all there is to know about JSON web tokens, and you should definitely check it out. Uh but To make it a little bit shorter, I'm going to show you the basics on how to create a JSON web token just using the Python standard library. Uh note, you shouldn't be doing this yourself. There are many uh third-party libraries out there that actually uh handle the encoding and decoding of these tokens and handle all the other special cases as well. So this is what a JSON web token looks like. It actually has three parts, which are base sixty-four encoded strings. With all trailing equal signs omitted. And are separated by periods.

So now I'm gonna be using this diagram to actually help us across building a token. In this diagram, the green represents a header, which specifies the algorithm we'll be using. To sign our token. The blue part actually represents the payload, the data you want to encode as a token. And the red part represents the signature So this is an example of a header. It 's JSON object containing a TYP key or type. That indicates that this object is in fact a JSON web token. And then it also has an algorithm or ALG key that indicates the algorithm we'll be using uh for the signature.

So in this case, we'll be using HS256, which actually stands for HMAC SHAT 256. Doing this with the standard library is pretty easy. You'll do some basic imports. You'll import the JSON module, the HMAC module. Um as I said, we're gonna be using the SHATA 56 algorithm. So we're gonna import that algorithm from the hash lib module. Then since our strings are actually base4 encoded uh string under safe or URLs, we'll actually be using the URL safe B64 encode m module from the uh mean Sorry, method for the base 64 model.

Um the first thing we're actually gonna be doing is creating a JSON string from our header dictionary. In this case, it contains the type and the algorithm, like I said before. So we create a URL-safe base64 and cut a string and we omit any equal signs from the end. Um if we were to this header uh value there would produce a string that if we will use it to replace our first part of the diagram would look like this. So we've replaced the green part of our diagram with our just generated header string. So now we'll be creating the second part of the of the payload, which act uh the token that contains the payload.

It's a blue part. In this case, our payload just contains a key, user ID, and its value. So similarly to how we already generated our router, we'll be creating a JSON string from our payload. Which contains user ID and its value. We'll then create a URL-safe basic C4 encoded string omitting any trailing equal signs. If we were to take that payload variable, it will produce a string which will be used in the second part of our token and replaced in our diagram will look like this. So now all that all that's left is actually creating the signature.

To create the signature, we need a secret key. And this secret key is shared between Between the two parties that will actually be encoding and decoding this token. In this case, my secret key is ABC123. That's not very secure, but it will do for now. So we then compute to compute the signature, uh we take our secret key, our encoded header and payload concatenated by the string. That's that second line there. And then we use our chosen algorithm, which for this example is HMAC shot fifty-six. We create a URL-safe basic silver encoded string from this HMAC objects digest, and

we omit again any trailing equal signs. So if we were to take that uh token variable, which actually puts back all our uh segments together, we'll end up with our token. We've just replaced the red part of our diagram with our signature string. Uh but like I said, you probably don't want to do this yourself every time. Um there are already uh many third-party libraries out there that are already tested and have uh cool features and actually uh implement all the cool parts of the spec. So uh just to be clear if we wanted to decode the token we

just created. We just reverse the steps we just did, right? So we'd first create a signature from the first two parts of our token. Um Then if the signatures match, we'll be able to correctly extract the payload by doing a B64 decode and correctly uh handling our user ID and our user value. So one of the uh the cool Python libraries that are out there is PyJWT. Um I happen to be one of the maintainers of it. Um you could install it from pip. And it's way simpler to use. We'll just import

it If we wanted to create a token from our payload, which in this case is this just the same as before, user ID1, we'd do jwt. encode. Center payload dictionary, use our secret key, and that would generate generate the exact same uh token we just saw. If we wanted to decode that and obtain our original payload dictionary, we'd do JDLT decode, send in our token string, use the same secret key, and you'd end up with the same payload dictionary. If the sec if the signature actually didn't match because you didn't use uh the same secret key used to encode the token, this library will raise an exception and let you know about it so you can handle it.

Um it also supports five other algorithms. We just saw HMAP, uh HMAC 256. Um, but you can also use RSA keys and other uh I know that algorithms. Um it also supports uh a cool claim from the uh from the standard that lets you uh add expiration time to these tokens. You can contribute to this project on GitHub. It's got like two years perhaps and and uh it's well tested. So check it out. So now if you use Django and you'd want to use JSON Web tokens for authentication, I just build a package. That provides JSON web

auth uh token authentication for Django. Um I released 0. 1 like two days ago, I think. Um so it's definitely uh pretty uh Uh and well it's it it's tested, but it still needs a couple of work done on it. Um so basically how it works is that it provides a view to authenticate a user. It returns a JSON web token from uh the user's username and password. And that token can be used to authenticate other requests. So to authenticate a request, you'd send the token you just received using the authorization HTTP header. It's already on PyPype, so you can install it. Pip install Django

dash JWT. And Right now it's pretty simple. Um it actually uh provides a mix-in called JSON Web Token Auth mix-in. Um if you're using class-based views, you can start using this. Um I should Put in there like a decorator or something for those using function-based views. Um but I like class-based views myself, so So you use that JSON with token authentication makes an on your class-based view. In this case, our restricted view actually uh returns a JSOS string with a key foo and the value bar. So if you plug in your URLs, um you can actually use a built-in view

uh that's provided. That's used for actually logging in with the username and password and returns the token. So that's our first URL there. And then we have our restricted view URL. Like I said, this is very uh beta um or alpha, I don't know. Um you can get involved and help shape the future of this uh project on GitHub. I'd gladly appreciate it. Now, if you're using Django RestrainMurt, uh, we've had a couple of talks on that, and maybe some of you are already using Django RestrameMerk I actually built this package first. Um it's a third party pack third party package that provides JSON web token authentication. You can install it from pip, pip install Django Rest framework dash

JWC And it works similarly to the one we saw, obviously. Um that was based off on this one. Um so it uses uh it provides an authentication class called JSON Web Token Authentication. Which if you've seen or work with Jangorse framework before, you'd plug it into your views authentication classes. And that's all you have to do. That view will automatically uh authenticate any requests coming from uh from a client. Um again, it provides uh a built-in View that you can use to obtain JSON tokens in logging in. So that's how we do it. And then uh a brief example of JavaScript

for a JavaScript uh client using jQuery. We'd first post to our login uh URL sending our username and password. Um it returns and it uh it will return uh our token. So we can use that and send it on the authorization. HTTP header to authenticate our get request to slash restricted That probably uh would return the success callback. And if you were to go do a console log on that, you'd see your foo bar JSON string. Um I yesterday or

yeah, I think yesterday I released version one point zero point one, which contains support for Django one point seven. Um This library is much more mature, it's much more well tested. So you can still get involved and help shape the future of it. So a brief recap of why JSON Web Tokens. It's standard and it's easy. Uh I I've read a lot of other standards on this kind of uh JSON message security and this one is by far the most easiest to understand and most easiest to actually implement. As we saw, we just implemented half of how it works in, you know, a few s a few lines of standard library Python.

Um there are tons of third-party libraries out there, um, not only for Python, but for Ruby, No, Go. Um it's works great for single sign-on scenarios. Um it's also cool for action links. And my preferred use case is for authentication. You don't have to struggle with cookies, cross-ordinate requests. It's stakeless, so you don't need to session store anymore. You don't have to deal with CSRF tags or anything like that. Having your client side app all host on a CDN is so much Well uh prettier and and faster and more performant.

And it also simplifies mobile and web socket authentication. I also wanted to point out that I am leading a Django Rest Framework sprint starting tomorrow. We're backed by Django Rest Frameworks original author, Tom Christie. So if you want to get your hands down and help move this product forward, you can find me around the hall and uh we'll get organized. Thanks.