JWT token signature validation javascript

Question

I was making a javascript client that connects to an Api using JWT tokens. On the server side there are no problems, I can create the token sign it and later verify the signature en thus ensure that nobody tampered with the token.

But how do I do this on the client side. I can just decode the JWT token and see the header, payload and signature. But how do i verify the signature at the client site? Are there libraries for this, how do I transfer the public key to the client?

If I do not verify the signature how can I know the token is not tampered with?

pedrofb pedrofb · Accepted Answer · 2017-12-15T16:57:24

if I do not validate the signature at the client side how can I ensure that the token is indeed from the server.? Maybe there is somebody in the middle who is changing the token

Signature validation does not avoid a Man In The Middle attack. An attacker could sniff the channel to capture credential or alter messages even using valid tokens

Use a SSL/TLS channel (https)

If I do not verify the signature how can I know the token is not tampered with?

A token provided by a TLS trusted server is probably valid.(it could has been altered in local storage). You can validate the signature. This operation is usually done in server side( see @sakuto answer), but you can do it in the browser perfectly

But how do i verify the signature at the client site?

These are the steps

Download the public key from a trusted server
extract the signature from JWT and decode it( base64url)
verify the digital signature using a cryptographic library

I suggest to use the Webcrypto. See an example of RSA import key an validation here: https://github.com/diafygi/webcrypto-examples/blob/master/README.md#rsassa-pkcs1-v1_5

JWT token signature validation javascript

3 Answers