JWTs have 3 parts:
Is it possible to
In fact there is not only signed JWT, but several technologies described by RFCs:
In your case, read the RFC7516 (JWE). These JWE have 5 parts:
Depending on your platform, you may find a library that will help you to create such encrypted JWT. Concerning PHP
, I am writting a library that is already able to load and create these jose.
Not encrypting the token means that other external services can read and validate that the token is in fact authentic without having access to your private key. (They would only need the public key)
Below is a very simple and effective method for encrypting using AES. Note you will need to get your own key (link included in comments).
Note that when you encrypt, it will set an IV for each encryption call. You will need this to decrypt.
public class CustomEncryption
{
public static string Encrypt256(string text, byte[] AesKey256, out byte[] iv)
{
// AesCryptoServiceProvider
AesCryptoServiceProvider aes = new AesCryptoServiceProvider();
aes.BlockSize = 128;
aes.KeySize = 256;
aes.Key = aesKey256();
aes.Mode = CipherMode.CBC;
aes.Padding = PaddingMode.PKCS7;
iv = aes.IV;
byte[] src = Encoding.Unicode.GetBytes(text);
using (ICryptoTransform encrypt = aes.CreateEncryptor())
{
byte[] dest = encrypt.TransformFinalBlock(src, 0, src.Length);
return Convert.ToBase64String(dest);
}
}
public static string Decrypt256(string text, byte[] AesKey256, byte[] iv)
{
AesCryptoServiceProvider aes = new AesCryptoServiceProvider();
aes.BlockSize = 128;
aes.KeySize = 256;
aes.IV = iv;
aes.Key = aesKey256();
aes.Mode = CipherMode.CBC;
aes.Padding = PaddingMode.PKCS7;
byte[] src = System.Convert.FromBase64String(text);
using (ICryptoTransform decrypt = aes.CreateDecryptor())
{
byte[] dest = decrypt.TransformFinalBlock(src, 0, src.Length);
return Encoding.Unicode.GetString(dest);
}
}
private static byte[] aesKey256()
{
//you will need to get your own aesKey
//for testing you can generate one from
//https://asecuritysite.com/encryption/keygen
return new byte[] { 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 2, 3, 4, 5, 6, 7, 8, 9, 1, 2, 3, 4, 5 };
}
}
}