ct-multi-tenant-keycloak-spring VS frank_jwt

https://github.com/czetsuyatech/ct-multi-tenant-keycloak-spring (sponsors only)

Take note from the above code on how we should create base64 string based on this MDN guide. Later we can validate manually if our jwt and the secretBytes is correct by pasting the token and secret to jwt.io.

When the user signs in, Cognito User pools will issue an ID token, which is a JSON Web Token (JWT). sub is one of the claims in the token and its value is the user pool ID of the user. It seems intuitive that the sub in the policy variable is the same as the user pool ID sub.

A web app can take various forms, from Single Page Apps (SPA) built with React, Vue, or Angular, to standard web applications crafted using frameworks like Express, NextJS, and similar platforms. The web app is our client app with frontend sends a request to an Identity Provider (Authgear) with client Id, a client secret to collect an access token like JSON Web Tokens (JWT).

Before creating the endpoint, let's make some helper functions to help us sign JWT tokens. JSON Web Tokens are used to exchange data between clients and servers in a secure manner. We will store the users’ information inside the browser's cookie storage as a JWT token for security reasons. JWTs contain user information encrypted and signed with a secret key. For more information about JWTs, you can read this article.

After the user has successfully authenticated, the user pool will return an ID token, which is a JSON Web Token (JWT).

When the program is running, the public key and private key in the first set of key pairs, as well as the issued JWT will be output to the console, where the key will be output in PEM format, we can directly copy them to the JWT.IO tool for verify.

Now if we copy the token that we got after the login and go to https://jwt.io/ and past the token and press decode

As is this implementation of the ME*N stack is exceptionally vulnerable to attack. There is no protection from error or misuse through the FE, which would be greatly improved by using a FE framework such as React, Angular, Vue etc. The FE/BE interface is also wide open to malicious actors. This can be improved by employing HTTPS to encrypt the communication path and implead “man-in-the-middle” attack. JWT can also be used to establish user authentication. The stack can also be made more robust and maintainable through the use of two Express middleware packages (Helmet and Mongoose).

I bet 99% of people assume that anything done in the browser happens "in the web", not on their own hardware. When an app is an exception, I'd certainly want it to let me know - e.g. jwt.io clarifies that the processing of sensitive data happens client-side and I don't think it comes off as bragging.