secure-web-token 1.2.9 → 1.2.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +27 -27
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -2,9 +2,13 @@
|
|
|
2
2
|
|
|
3
3
|
> **The secure alternative to JWT** — encrypted, device-bound, and built for production security.
|
|
4
4
|
|
|
5
|
-
[](https://www.npmjs.com/package/secure-web-token)
|
|
6
|
+
[](https://github.com/your-username/secure-web-token/stargazers)
|
|
7
|
+
[](https://www.npmjs.com/package/secure-web-token)
|
|
8
|
+
[](https://www.npmjs.com/package/secure-web-token)
|
|
9
|
+
[](https://github.com/your-username/secure-web-token)
|
|
10
|
+
[](https://github.com/your-username/secure-web-token/pulls)
|
|
11
|
+
[](https://snyk.io/test/github/your-username/secure-web-token)
|
|
8
12
|
|
|
9
13
|
```bash
|
|
10
14
|
npm install secure-web-token
|
|
@@ -16,13 +20,13 @@ npm install secure-web-token
|
|
|
16
20
|
|
|
17
21
|
**JWT has well-known, unfixed security flaws.** If you are using JWT in a security-critical app and have not thought about these, you should stop and read this:
|
|
18
22
|
|
|
19
|
-
| Problem
|
|
20
|
-
|
|
21
|
-
| Payload encryption
|
|
22
|
-
| Device binding
|
|
23
|
-
| True logout
|
|
24
|
-
| Token theft impact
|
|
25
|
-
| Sensitive data in token | ❌ Visible in browser devtools
|
|
23
|
+
| Problem | JWT | SWT (Secure Web Token) |
|
|
24
|
+
| ----------------------- | ------------------------------------- | -------------------------------------------- |
|
|
25
|
+
| Payload encryption | ❌ Base64 only (readable by anyone) | ✅ AES-256-GCM encrypted |
|
|
26
|
+
| Device binding | ❌ Token works on any device | ✅ Bound to one device/session |
|
|
27
|
+
| True logout | ❌ Tokens stay valid after logout | ✅ Server-side revocation |
|
|
28
|
+
| Token theft impact | ❌ Stolen token = full account access | ✅ Stolen token is useless on another device |
|
|
29
|
+
| Sensitive data in token | ❌ Visible in browser devtools | ✅ Encrypted, never exposed |
|
|
26
30
|
|
|
27
31
|
> **If you are storing user roles, permissions, or any sensitive identifiers in a JWT — they are readable by anyone with the token.** SWT fixes this.
|
|
28
32
|
|
|
@@ -66,15 +70,11 @@ import { sign } from "secure-web-token";
|
|
|
66
70
|
|
|
67
71
|
const SECRET = "your-256-bit-secret";
|
|
68
72
|
|
|
69
|
-
const { token, sessionId } = sign(
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
store: "memory", // server-side session store
|
|
75
|
-
expiresIn: 3600, // 1 hour
|
|
76
|
-
}
|
|
77
|
-
);
|
|
73
|
+
const { token, sessionId } = sign({ userId: 1, role: "admin" }, SECRET, {
|
|
74
|
+
fingerprint: true, // bind to device
|
|
75
|
+
store: "memory", // server-side session store
|
|
76
|
+
expiresIn: 3600, // 1 hour
|
|
77
|
+
});
|
|
78
78
|
|
|
79
79
|
// Send `token` to client, store `sessionId` in HttpOnly cookie
|
|
80
80
|
```
|
|
@@ -85,7 +85,7 @@ const { token, sessionId } = sign(
|
|
|
85
85
|
import { verify, getStore } from "secure-web-token";
|
|
86
86
|
|
|
87
87
|
const store = getStore("memory");
|
|
88
|
-
const session = store.getSession(sessionId);
|
|
88
|
+
const session = store.getSession(sessionId); // from HttpOnly cookie
|
|
89
89
|
|
|
90
90
|
const payload = verify(token, SECRET, {
|
|
91
91
|
sessionId,
|
|
@@ -199,12 +199,12 @@ If a JWT is stolen via XSS or network interception, the attacker has full access
|
|
|
199
199
|
|
|
200
200
|
### How SWT Fixes Every One of These
|
|
201
201
|
|
|
202
|
-
| JWT Flaw
|
|
203
|
-
|
|
204
|
-
| Readable payload
|
|
205
|
-
| No device binding
|
|
206
|
-
| Logout doesn't work | Server-side session deletion — revocation is instant and permanent
|
|
207
|
-
| Token theft
|
|
202
|
+
| JWT Flaw | SWT Solution |
|
|
203
|
+
| ------------------- | --------------------------------------------------------------------------------- |
|
|
204
|
+
| Readable payload | AES-256-GCM encryption — payload is unreadable without the server secret |
|
|
205
|
+
| No device binding | Device fingerprint stored in server session — token only valid on original device |
|
|
206
|
+
| Logout doesn't work | Server-side session deletion — revocation is instant and permanent |
|
|
207
|
+
| Token theft | Stolen token cannot be used without matching device fingerprint + server session |
|
|
208
208
|
|
|
209
209
|
---
|
|
210
210
|
|
|
@@ -289,4 +289,4 @@ MIT
|
|
|
289
289
|
---
|
|
290
290
|
|
|
291
291
|
> **Stop using JWT for sensitive user sessions. Your users deserve better.**
|
|
292
|
-
> `npm install secure-web-token`
|
|
292
|
+
> `npm install secure-web-token`
|