mark JWT as invalid at /logout

[gpanula]

Describe the problem

After logging out, you can still pass vouch's validate handler with the captured cookie.

Expected behavior

vouch should not allowed a logged out session to re-use a cookie to log in.

Additional context

Steps to replicate

1. log into a site (vouch /login)
2. capture the cookie that stores the jwt (cooke: name in config.yml)
   -- easiest method is using developer console in chrome and just copy the whole request to curl
3. log out of the site (vouch /logout)

Run the curl command that has the captured cookie.

This bit of code
https://github.com/vouch/vouch-proxy/blob/master/handlers/handlers.go#L98
will see the valid jwt in the cookie and the request will pass vouch's /validate handler

I think the crux of the problem is that vouch doesn't validate the jwt with the issuer. It is just looks for a jwt and is happy when it finds one.

[bnfinet]

Vouch Proxy is the issuer of the jwt which is carried in the cookie.

The /logout endpoint does not mark the jwt as 'invalid' in any way, it just removes the cookie from the browser.

There is no outside validation of the jwt, even though that jwt may contain sub tokens derived from an IdP. Those sub tokes are not validated. It would be onerous to do such on each request.

Your best bet is to to keep vouch.jwt.maxAge short. The JWT is validated for expiration.

[bnfinet]

related #40 #111

[gpanula]

Thank you very much for the quick reply and clarification. That makes sense. I was traveling down the wrong path of attempting to use vouch's user authentication for session management.

related
http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/

[bnfinet]

Thanks, that link has good advice IMHO.

You can always immediately invalidate all tokens by changing the vouch.jwt.secret. This is the suggested practice for the "firing an employee" use case when using cookies that last for any appreciable length of time.

[svrooij]

Microsoft adds a random guid to every issued token, I think it's in the jti (json token id) claim. Then you would be able to keep a list of "revoked" tokens. Items on that list could be cleared after the maxage of the token has passed since adding it to the list.

The list would be kept relatively small since you can clear the items after the set max age. The flow could then be:

1. Is the JWT valid (like it checks it now)
2. Is the jti on the list of revoked tokens.
3. Continue as normal

---

I'm not saying this is the best way to go, this is just how it could be implemented without much speed decrement. By keeping this optional users could choose to turn this on.

When deploying multiple instances of VouchProxy with the same key, you will need some sort of distributed place to store the revoked keys, like redis.