Using NodeJS, how can I retrieve session information stored in PostgreSQL using the JWT made by Spring Security OAuth2?

Question

I have a Java spring backend that is using LDAP for user accounts and spring-security for authentication.

I also use spring-security-oauth2 for client authentication and I have a client authenticated with a JWT.

Using that JWT, how can I use NodeJS to decrypt the JWT and retrieve the session information (user and roles) in my database?

I also have a X-XSRF-TOKEN I think I need to verify (cookie).

Is it possible?

Community · Accepted Answer · 2020-06-20 09:12:55Z

1

I have a Java spring backend that is using LDAP for user accounts and spring-security for authentication.

I also use spring-security-oauth2 for client authentication and I have a client authenticated with a JWT.

The whole idea of JWT is that it is stateless (no sessions). If you have an unique solution where sessions are somehow tied to JWT, you should include a diagram or more description.

Using that JWT, how can I use NodeJS to decrypt the JWT and retrieve the session information (user and roles) in my database?

You can use JsonWebToken library and store/retrieve the username (or some other type of user or session identification token) in the subject field.

I also have a X-XSRF-TOKEN I think I need to verify (cookie).

CSRF/XSRF is usually disabled in JWT applications (see accepted answer here CSRF Token necessary when using Stateless(= Sessionless) Authentication?). In spring boot the middleware is enabled by default, but can be disabled like so:

@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable();
    }
}

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Jun 14, 2018 at 6:58

Michal

2,31326 silver badges40 bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Dimitri Kopriwa Over a year ago

I wonder, why would you decode the token in NodeJs if you actually need to work with it in the backend? NodeJS is a backend, and I want to extend the backend with nodejs and use the same users and perms, does it make more sens to you now?

Michal Over a year ago

I updated my response with a more relevant NodeJs library.

Dimitri Kopriwa Over a year ago

The jwt is not tied to the session but the session is required to get the JWT. But now I remember you only need it to get the JWT. I wonder because the JWT contains roles and users, how can I verify that the JWT as not been modified (within node)?

Michal Over a year ago

@BigDong In my view of JWT, needing session to get the JWT still doesn't make sense. JWT is usually passed in request header for every request, which is what makes it suitable for stateless operation. The JWT is issued by the server, using secure password. Unless an attacker gets hold of that password, they should not be able to modify the token. I suggest doing some reading on the principles of JWT jwt.io/introduction

Michal Over a year ago

@BigDong Good reading here: stackoverflow.com/questions/27301557/…

|

Collectives™ on Stack Overflow

Using NodeJS, how can I retrieve session information stored in PostgreSQL using the JWT made by Spring Security OAuth2?

1 Answer 1

7 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related