Published in · 5 min read · Feb 22, 2023
--
In modern web applications, authentication and authorization are essential components of ensuring secure and private user experiences. One key decision that developers must make when implementing these features is whether to use JSON Web Tokens (JWTs) or opaque tokens. In this article, we will explore the differences between JWTs and opaque tokens, and examine the scenarios where each type of token is best suited for use.
JWTs are self-contained tokens that are used to store user identity and access information in a compact format. They are composed of three parts: Header, Payload, and Signature. The header contains information about the type of token and the algorithm used to sign it, while the payload contains user information. The signature is used to verify the authenticity of the token and prevent tampering.
How JWT is generated
Both the header and the payload are in JSON format and are encoded by Base64. Therefore they can be decoded by any JWT decoder.
The signature is signed by the algorithm mentioned in the header using a secret key.
As an example, you can verift the following JWT using https://jwt.io/. The signature can be validated by using the secret qwertyuiopasdfghjklzxcvbnm123456.
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJPbmxpbmUgSldUIEJ1aWxkZXIiLCJpYXQiOjE2NzcwNDc2MTYsImV4cCI6MTcwODU4MzYxNiwiYXVkIjoid3d3LmV4YW1wbGUuY29tIiwic3ViIjoianJvY2tldEBleGFtcGxlLmNvbSIsIkdpdmVuTmFtZSI6IkpvaG5ueSIsIlN1cm5hbWUiOiJSb2NrZXQiLCJFbWFpbCI6Impyb2NrZXRAZXhhbXBsZS5jb20iLCJSb2xlIjpbIk1hbmFnZXIiLCJQcm9qZWN0IEFkbWluaXN0cmF0b3IiXX0.lJhkwwYVGfPkIIf-I6C-MFMLz61mZlNYYJSlsjUt4XoHow JWT works
When a user logs into a web application, the server generates a JWT token containing the user’s identity information, such as username, email, or user ID. The server sends the JWT token to the client, which stores it locally in a cookie or in local storage. The server then validates the token to ensure its authenticity and retrieve the identity information. The server checks the token’s signature, decodes it, and checks its expiration time to make authorization decisions and grant access to protected resources.
Pros
- Stateless: JWT tokens allow for stateless authentication, reducing server load and improving scalability.
- Cross-platform: JWT tokens are platform-independent.
- Compact: JWT tokens have a small size, making them efficient for transmitting user identity information between the client and server.
- Flexible: JWT tokens can be customized to store additional user information in the token payload, such as user ID, roles, or permissions.
- Standardized: JWT tokens follow a well-defined standard (RFC 7519), making them easy to implement and understand.
Cons
- Token size: While JWT tokens are compact, they can become large if they contain a lot of user information.
- Token security: JWT tokens can be vulnerable to attacks such as token substitution or replay attacks if not properly implemented with secure encryption and validation mechanisms.
- Token revocation: JWT tokens are typically valid for a set period of time, and there is no built-in mechanism for revoking tokens before they expire, meaning that a compromised token may remain valid until it expires.
- Token storage: Since JWT tokens contain user information, they need to be stored securely.
Opaque tokens, unlike JWT tokens, do not contain any user information, and are instead represented by a random, unique string of characters. Instead, they are simply identifiers that are mapped to user information stored on the server.
How Opaque Tokens Work
When a user requests access to a protected resource, the server generates an opaque token and sends it to the client. To validate the token and retrieve user information, the server must make a separate call to the authorization server, which issued the opaque token. The authorization server maintains a database of valid opaque tokens and the user information associated with them, and when the server receives an opaque token from the client, it sends a request to validate it and retrieve the associated user information. The server then receives a token introspection result, which includes information about the validity of the opaque token and any associated user information, and can use this information to make authorization decisions and grant access to the requested resource.
Pros
- Secure: Opaque tokens do not contain any user information, making them more secure than JWT tokens.
- Flexible: Opaque tokens can be customized to store additional user information in the authorization server, which can be retrieved by the resource server when needed.
- Token revocation: Opaque tokens can be revoked by the authorization server at any time, providing an additional layer of security in case of a compromised token.
- Token size: Opaque tokens can be smaller in size than JWT tokens since they do not contain user information.
Cons
- Stateful: Opaque tokens require the resource server to maintain a stateful session, increasing server load and reducing scalability.
- Performance: Opaque tokens require additional network calls to the authorization server for token validation and user information retrieval, which can affect performance.
- Interoperability: Opaque tokens may not be compatible with all programming languages and frameworks, making them less flexible and interoperable than JWT tokens.
- Standards: Opaque tokens are not a well-defined standard like JWT tokens, meaning that their implementation may vary across different systems, potentially leading to interoperability issues.
In general, JWTs are better suited for scenarios where the server needs to quickly access user information and where token-based authentication is used across multiple services. For example, if you are building a distributed system that requires authentication and authorization across different services, JWTs can be a good choice because they are easy to transmit and verify.
On the other hand, opaque tokens are better suited for scenarios where the server needs to maintain more control over user information and where there is a greater emphasis on security and privacy. For example, if you are building an application that requires the storage and transmission of sensitive information, opaque tokens can be a good choice because they do not reveal any information about the user.
Ultimately, the choice between JWTs and opaque tokens depends on the specific requirements of your application and the security and privacy considerations that are most important to you. By understanding the differences between these two types of tokens and their strengths and weaknesses, you can make an informed decision about which type of token is best suited for your application.
