使用 JWT 保护 Rest API
我正在尝试使用 JWT 来保护其余 API 端点的安全。我查看了一些相关问题此处和此处。
我在 JWT 中有一些敏感信息，但我使用的是 HTTPS，因此数据已经加密，这样就足够了，还是我必须加密 JWT ？
I'm trying to secure the rest API endpoint with JWT. I looked at a few related questions here and here.
I have some sensitive information in the JWT but I'm using HTTPS, so the data is already encrypted so would that be enough, or do I have to encrypt JWT ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
HTTPS 为您提供传输加密。这意味着如果有人拦截您的消息，他们将无法阅读它。但安全连接由浏览器（在用户端）终止，并且通常由服务器端的负载均衡器或 API 网关终止。这意味着任何有权访问浏览器的人都可以免费使用 JWT。也有可能从您的网络内部读取或窃取该数据（一旦通过网关/负载均衡器）。这是一个低得多的威胁，但它仍然存在。
如果 JWT 中有敏感信息，则有两个选项：
您可以加密 JWT（因此使用 JWE）。这样令牌的内容在浏览器中将是安全的。即使有人读取或拦截那里的令牌，他们也无法读取它。不过，JWE 的设置有点棘手。
使用幻像令牌模式。在此模式中，您向客户端发出不透明令牌，并让 API Gateway 将不透明令牌交换为 JWT。这样，您的敏感信息就可以远离浏览器，但您的 API 仍然可以从 JWT 的强大功能中受益。它也不需要设置加密。它使您容易受到网络内任何恶意行为者（无论是来自您的组织还是设法突破您的防御的人）的攻击，但这种风险要低得多。
HTTPS gives you encryption in transport. This means that if anyone intercepts your message they will not be able to read it. But the secure connection is terminated by the browser (at the user side) and very often by a load balancer or API gateway at the server side. This means that the JWT will be freely available to anyone with access to the browser. There is also a possibility that it will be read or stolen from inside your network (once it's past the Gateway/load balancer). This one is a much lower threat, but it nevertheless exists.
If you have sensitive information in the JWT, then there are two options:
You can encrypt JWTs (so use JWEs). This way the token's contents will be secure in the browser. Even if someone reads or intercepts the token there, they will not be able to read it. JWE is a bit tricky to set up, though.
Use the Phantom Token pattern. In this pattern, you issue opaque tokens to the client and have your API Gateway exchange the opaque token for a JWT. This way your sensitive information is kept away from the browser but your APIs can still benefit from the power of the JWT. It also doesn't require setting up encryption. It leaves you vulnerable to any malicious actors inside your network (either from your organization or someone who manages to breach your defenses), but this is a much lower risk.