JASON Web Token

This feature is applicable only to version 22.3 and later.

JSON Web Token (JWT) is an open standard that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

Once encoded in a URL-safe form the JWT can be transferred from a client to a server as part of a URL query string or in a HTTP header.

The signing and verification of JWT tokens requires cryptographic keys, either in the form of a shared secret, the public part of an asymmetric key-pair, or the entire key-pair depending on the desired mode of operation.

The Traffic Manager uses JWT catalogue to provide a centralized store of JWT keys. The JWT catalogue contains shared secrets, public and private keys that can be used to validate or generate a JWT, with the following vTM configuration:

Import RSA/ECDSA Public Key - import a PEM encoded RSA or ECDSA Public Key

Generate RSA/ECDSA Key Pair - generate public, private key RSA or ECDSA key pair

Configure HMAC Shared Secret - configure a HMAC shared secret in base64 encoded format

Deployment Use Case

JWT is simply a standardized way of sending information between parties, and it is possible that a JWT token could safely send via,

URL query parameters of a HTTP request – Not recommended. (JWTs could become too long for most browsers. Browsers have limits on the length of URLs, and it’s possible for JWT tokens to be longer than those limits.)

Authorization header of a HTTP request – Recommended. (Authorization: Bearer <token>)

The Traffic Manager uses the following traffic script functions to parse, validate and generate the JWT tokens.

jwt.parseheader( Input string ) : Parse the header of a JWT token and returns a hash of "error" and "description" if parsing fails else hash of key/value pairs present in header.

jwt.validate( Input string, key, key_file, algorithm ) : Validates the JWT token against the provided key with expected algorithms and return the hash of "error" and "description" if validation fails or "claim" if validation is successful.

jwt.generate( Input string, key, key_file ) : Generate the signature or digest for the input token( encoded jose header and claims ) using provided key and return the hash of "error" and "description" if generation fails or "signature" if generation is successful.