Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • 3
    Adding the IP address and even verifying it won't remove the consequences of the compromised token secret. If the token secret is compromised, a 3rd party can sign forged tokens (which would include a forged IP address or expiration date). The token secret is vital. Commented Apr 15, 2015 at 17:41
  • 2
    I agree, but everything above I have mentioned is with respect to Token itself. It is assumed that a token secret is never compromised and lives inside the server in a secure way. Its a different challenge on its own. Commented Apr 16, 2015 at 6:57
  • 1
    got it. I guess I was just pointing out the OP specifically asked about a "compromised token secret" in question #1. Commented Apr 17, 2015 at 16:35
  • 1
    Oh! Thanks for pointing it out. I am now confused. :-) However, taking another look at Question #1 ("token secret which is shared between a client and the server"), make me think again. A Token Secret is never shared with the client. I wonder what the author was actually referring to. Commented Apr 27, 2015 at 16:11
  • Because the IP address can be spoofed, validating the IP address against the JWT will not always be effective. The attacker may not be able to extract information with a GET request. But if the attacker uses a POST or PUT they may be able to modify the server with the un-expired JWT. Commented Jun 24, 2015 at 16:32