PHP Experience 2016 - [Palestra] Json Web Token (JWT)
- 2. Ivan Rosolen
Graduado em Sistemas de Informação
Pós-graduado em Gerência de Projetos
Desenvolvedor a 15+ anos
Autor de vários PHPT (testes para o PHP)
Entusiasta de novas tecnologias
Head of Innovation @ Arizona
CTO @ Mokation
- 5. - Form Request Post/Get
- OAuth
- Key/Hash
- Credenciais em plain text
- Session Cookies
- 6. - Data is stored in plain text on the server
- Filesystem read/write requests
- Distributed/clustered applications
- Redis/Sticky sessions
- 8. - Stateless authentication (simplifies horizontal scaling)
- Prevent (mitigate) Cross-Site Request Forgery (CSRF)
attacks.
- Security (https)
- Authorization: Bearer
- 11. - JWT
- JWS
- JWA
- JWK
- JWE
JSON Object Signing and Encryption
- 13. - JSON Web Tokens work across different programming languages
- JWTs are self-contained
- JWTs can be passed around easily and secure
- Better control like “one time token” to forgot password, confirm
user, request rates, access, etc.
- One token to rule them all (Stateless)
- 17. Claims
- iss: The issuer of the token
- sub: The subject of the token
- aud: The audience of the token
- exp: This will probably be the registered claim most often used. This will define the expiration
in NumericDate value. The expiration MUST be after the current date/time.
- nbf: Defines the time before which the JWT MUST NOT be accepted for processing
- iat: The time the JWT was issued. Can be used to determine the age of the JWT
- jti: Unique identifier for the JWT. Can be used to prevent the JWT from being replayed. This is
helpful for a one time use token.
http://www.slideshare.net/lcobucci/jwt-to-authentication-and-beyond
- 24. Screencast
Utilizando PHP será explicado como gerar de forma manual (sem uso de
qualquer biblioteca) um JSON Web Token, que pode ser utilizado para
compartilhar informações entre aplicações e autorizar o portador do
token a acessar dados protegidos.
https://www.youtube.com/watch?v=k3KfK0ZS_FY