Does JWT Authorization entirely depend upon the secret key? - authentication

Question

According to my understanding a JWT can be broken down into a Header, Payload and a Signature. The signature is created using Header+Payload+Secret. The secret is stored by the server and is never shared.
When a client sends a JWT to the server. The server can authorize it by accessing the Header , Payload received from JWT and combine it with the secret to create a Test Signature. Then the server can check if Test Signature = Signature received from the client JWT and make sure the data is not altered.
• Does this mean that the entire JWT authorization is dependent on the Secret and the whole authorization process is compromised if it is leaked?

Answer 1

Secret is matter to verify JWT
This diagram is normal sequence to use JWT for accessing resource by API call.
I would like to demo with real code.
Using jsonwebtoken java-script library on node-js
1. JWT generate step.
function name: generate_token()
first function parameter: secret
second function parameter: user name (or payload)
const jwt = require("jsonwebtoken")
const jwtExpirySeconds = 600
const generate_token = (jwtKey, username) => {
const token = jwt.sign({ username }, jwtKey, {
algorithm: "HS256",
expiresIn: jwtExpirySeconds,
})
console.log("JWT token:", token, '\n')
const [header, payload, signature] = token.split(".")
console.log("1) header:", header)
console.log(JSON.parse(Buffer.from(header, "base64").toString("utf8")), '\n')
console.log("2) payload:", payload)
console.log(JSON.parse(Buffer.from(payload, "base64").toString("utf8")), '\n')
console.log("3) signature:", signature)
}
const my_args = process.argv.slice(2);
generate_token(my_args[0], my_args[1]);
generate token with secret and user name
$ node generate_token.js my-secret user1
JWT token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InVzZXIxIiwiaWF0IjoxNjU5NDA3NzQ0LCJleHAiOjE2NTk0MDgzNDR9.MMIxotVJjMBLFOg0nusePz4L62n7VZ4Q-fW_u392qDQ
1) header: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
{ alg: 'HS256', typ: 'JWT' }
2) payload: eyJ1c2VybmFtZSI6InVzZXIxIiwiaWF0IjoxNjU5NDA3NzQ0LCJleHAiOjE2NTk0MDgzNDR9
{ username: 'user1', iat: 1659407744, exp: 1659408344 }
3) signature: MMIxotVJjMBLFOg0nusePz4L62n7VZ4Q-fW_u392qDQ
2. Verify JWT step.
function name: verify_token()
first function parameter: secret
second function parameter: JWT token
const jwt = require("jsonwebtoken")
const verify_token = (jwtKey, token) => {
try {
payload = jwt.verify(token, jwtKey)
console.log("JWT token verify:", payload, '\n')
} catch (e) {
if (e instanceof jwt.JsonWebTokenError) {
console.log("JWT token error: 401")
return
}
// otherwise, return a bad request error
console.log("JWT token error: 400")
}
}
const my_args = process.argv.slice(2);
verify_token(my_args[0], my_args[1]);
2.1 verify token with correct secret and JWT token
$ node verify_token.js my-secret eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InVzZXIxIiwiaWF0IjoxNjU5NDA3NzQ0LCJleHAiOjE2NTk0MDgzNDR9.MMIxotVJjMBLFOg0nusePz4L62n7VZ4Q-fW_u392qDQ
JWT token verify: { username: 'user1', iat: 1659407744, exp: 1659408344 }
2.2 if verify token with wrong secret and same JWT token
$node verify_token.js wrong-secret eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InVzZXIxIiwiaWF0IjoxNjU5NDA3NzQ0LCJleHAiOjE2NTk0MDgzNDR9.MMIxotVJjMBLFOg0nusePz4L62n7VZ4Q-fW_u392qDQ
JWT token error: 401