Question: Prevent a token generated on System A to be used on System B

tuupola / slim-jwt-auth

PSR-7 and PSR-15 JWT Authentication Middleware

https://appelsiini.net/projects/slim-jwt-auth

MIT License

821 stars 140 forks source link

Closed IAmWebSA closed 2 years ago

IAmWebSA commented 3 years ago

Hello,

I wanted to know or even better see an example how to prevent a token generated on System A to be used on System B, if they use the same secret key.

What would be the best secure solution?

Reject the token if it comes from another "issuer" system
Create a dynamic Secret for each system and therefore the token would fail to be decoded.

From my feeling Solution 2 would be the more robust and secure one.

Do you agree or any other thoughts?

Many Thanks in advance

tuupola commented 3 years ago

I would use different secret for each system ie solution 2 .