https://github.com/crgwbr/asymmetric-jwt-auth

Django App for machine to machine authentication using JWT and RSA key pairs
https://github.com/crgwbr/asymmetric-jwt-auth

Last synced: 3 months ago
JSON representation

Django App for machine to machine authentication using JWT and RSA key pairs

• Host: GitHub
• URL: https://github.com/crgwbr/asymmetric-jwt-auth
• Owner: crgwbr
• License: isc
• Created: 2015-08-18T17:30:47.000Z (about 9 years ago)
• Default Branch: master
• Last Pushed: 2024-06-26T19:41:42.000Z (4 months ago)
• Last Synced: 2024-06-27T16:36:13.239Z (4 months ago)
• Language: Python
• Size: 211 KB
• Stars: 37
• Watchers: 4
• Forks: 9
• Open Issues: 14
• Metadata Files:
  • Readme: README.rst
  • License: LICENSE.md

Awesome Lists containing this project

• starred-awesome - asymmetric-jwt-auth - Django App for machine to machine authentication using JWT and RSA key pairs (Python)

README

        
Asymmetric JWT Authentication

=============================

.. image:: https://img.shields.io/pypi/v/asymmetric_jwt_auth.svg

    :target: https://pypi.python.org/pypi/asymmetric_jwt_auth

.. image:: https://gitlab.com/crgwbr/asymmetric_jwt_auth/badges/master/pipeline.svg

    :target: https://gitlab.com/crgwbr/asymmetric_jwt_auth/-/commits/master

.. image:: https://gitlab.com/crgwbr/asymmetric_jwt_auth/badges/master/coverage.svg

    :target: https://gitlab.com/crgwbr/asymmetric_jwt_auth/-/commits/master

What?

-----

This is an library designed to handle authentication in

*server-to-server* API requests. It accomplishes this using RSA public /

private key pairs.

Why?

----

The standard pattern of using username and password works well for

user-to-server requests, but is lacking for server-to-server

applications. In these scenarios, since the password doesn’t need to be

memorable by a user, we can use something far more secure: asymmetric

key cryptography. This has the advantage that a password is never

actually sent to the server.

How?

----

A public / private key pair is generated by the client machine. The

server machine is then supplied with the public key, which it can store

in any method it likes. When this library is used with Django, it

provides a model for storing public keys associated with built-in User

objects. When a request is made, the client creates a JWT including

several claims and signs it using it’s private key. Upon receipt, the

server verifies the claim to using the public key to ensure the issuer

is legitimately who they claim to be.

The claim (issued by the client) includes components: the username of

the user who is attempting authentication, the current unix timestamp,

and a randomly generated nonce. For example:

::

    {

        "username": "guido",

        "time": 1439216312,

        "nonce": "1"

    }

The timestamp must be within ±20 seconds of the server time and the

nonce must be unique within the given timestamp and user. In other

words, if more than one request from a user is made within the same

second, the nonce must change. Due to these two factors no token is

usable more than once, thereby preventing replay attacks.

To make an authenticated request, the client must generate a JWT

following the above format and include it as the HTTP Authorization

header in the following format:

::

    Authorization: JWT 

**Important note**: the claim is *not* encrypted, only signed.

Additionally, the signature only prevents the claim from being tampered

with or re-used. Every other part of the request is still vulnerable to

tamper. Therefore, this is not a replacement for using SSL in the

transport layer.

**Full Documentation**: https://asymmetric-jwt-auth.readthedocs.io