Is JWT necessary over HTTPS communication?

Question

I\'m developping a MEAN stack application, and I\'m currently setting up an account system. I\'ve seen several tutorials about Authentication, all using JWT. I

Answer 1

Nowadays developers prefer Token-Based Authentication instead of Session. Token-Based Authentication have lots of advantages over Session. We use JWT i.e. JSON Web Token to generate a token after user authentication, every time your front-end app makes an API call so your system should check whether the request has the valid token or not if it is there and it is valid then it considered as the valid user.

In short, we use JWT to validate our API calls it is nothing to do with HTTP or HTTPS

Answer 2

No, JWT is not required when your server supports HTTPS. HTTPS protocol ensures that the request & response are encrypted on the both(client & server) the ends.

I believe you would want to send across user credentials in every request to the server, and in turn server validates the user before sending any response from the server.

Although you can do the above, but on the server-end, you would end up validating user credentials against a Database in every request which is a expensive task, you can avoid this when you use JWT.

JWT basically authenticates a user once & issues an access token which could be valid for a duration of time.

Answer 3

Is JWT necessary over HTTPS communication?

No. Communication protocol (HTTP v.s. HTTPS) is one thing, and authentication mechanism (JWT v.s. Session) is another -- these are 2 totally different area.

For communication protocol (HTTP v.s. HTTPS), HTTPS can be used alone, without any JWT tokens or sessions. For example, a static web site can be made (only HTML+CSS) and served with HTTPS. In this way, the web site can be certificated by CA and prevent forge attack.

Even if you need authentication in web application, JWT token is not the only choice. Session is old technology but it is still reliable, which made JWT definitely NOT necessary.

Answer 4

JWT should not be confused with encryption. From jwt.io:

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.

The JWT is signed with public/private key pairs so the sender can be verified, and verified that the payload has not been modified. However, the JSON Web Token is in clear text.

var token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ";

var payload = token.split('.')[1];

console.log('Payload: '+atob(payload))

Below is a figure from jwt.io showing the authentication flow when using JWT.

You need SSL/HTTPS to encrypt the communication. Without SSL/HTTPS attackers can sniff the network traffic and obtain the JWT, hence your application is vulnerable to man in the middle attacks.