HexaEightJWTLibrary 1.8.7

HexaEight JWT Library

How To Use The Library

Visit HexaEight For More Information

Code Sample

Initialization

var newjwt = new HexaEightJose.JWT();

newjwt.Initialize();

Set HexaEight Resource Name via CommandLine

newjwt.Setresourcename();

Set HexaEight Resource LoginToken via CommandLine

newjwt.Setlogintoken();

Set HexaEight Resource LoginToken Credential via CommandLine

newjwt.Setpassword();

Set Rapid API Key via CommandLine

newjwt.Setapikey();

Once the above is set, an encrypted JWT as shown in the below sample can be generated for any destination resource.

newjwt.AddPayloadItem("aud", destinationresourcename);

newjwt.AddPayloadItem("clientxmlpubkey", xmlpublickey);

newjwt.AddPayloadItem("user", "anyuser@somedomain.com");

newjwt.AddPayloadItem("sessionid", sessionid);

newjwt.AddPayloadItem("sessionpassword", sessionpassword);

newjwt.AddPayloadItem("tokentype", "AccessToken");

Set the JWT token expiration in minutes.

var encryptedtoken = newjwt.CreateEncryptedJWTToken(resource, 1440);

At the Destination resource, Initialize and Set HexaEight Destination resource credentials and decrypt the token using the below command.

var decryptedaccesstoken = newjwt.ValidateToken(encryptedtoken);

Added Support for Managing JWT Sessions - New in Version 1.7.5

Added Support for Creating Simple JWT without HexaEight Encryption but using a Symmetric Password - New in Version 1.8.1

Added Support for HexaEight Client Encryption using JWT - New in Version 1.8.6

Added Authentication Functions for Clients - New in Version 1.8.7

1. InitiateLoginProcess

var clientjwt = new HexaEightJose.JWT();

var clientcode = clientjwt.InitiateLoginProcess("http://localhost:5000/api/fetch-client-code", clientid);

2. FetchLoginQRCode (Capture a password for the session from the user and use the password to fetch the QRCode)

Console.Write("Enter a strong password to secure this Client Session : ");

var clientpassword = clientjwt.ReadPassword();

var qrcoderesp = clientjwt.FetchLoginQRCode(clientcode, clientpassword);

3. DisplayLoginQRCode

clientjwt.DisplayLoginQRCode(qrcoderesp);

4. FetchLoginToken

var logintoken = FetchLoginToken(qrcoderesp, clientpassword);

5. FetchLoggedInUserUsingLoginToken

var loggedinuser = FetchLoggedInUserUsingLoginToken(logintoken);

6. FetchAppNameUsingLoginToken

var appname = FetchAppNameUsingLoginToken(logintoken);

7. FetchResourceIdentityUsingLoginToken

var resourcename = FetchResourceIdentityUsingLoginToken(logintoken);

Below is a a sample JWT generated using HexaEight JWT Library. The contents of this JSON Web Token can be verified from https://jwt.io

eyJhbGciOiJIUzI1NiIsImtpZCI6IjU2TXNjdXdNRlM4dFJ6VURLQ2dlbXpLYkJvcGRVRzlxYno5K2dFcFdWMzExQ3NTSW1aTGVKdUpMSWwwN2VraUpabG9QbHJCbWk1TWFlK3FTVnNtMm80RE1rUjZqS3VvYVhYdDlTeWxuK2tZSkVDZzZkVkV6WmtBcVF4SXZFRjRMS1J3d1FTTXVsR2Y5QkpJcjdUYjRsSFJkQ1NhaEFPcEt2WldMb0JhRVFpQ0N6SDhuWUFOaUhRTU9KNWNObm5vVitFMzRoUkpZZzVieGV0OVBTb2lRUEtBaTYwTTZZcHRKa3lsN1J1WlZlSHZlSTdOeDhYSjZXZk1neGx5ZlVwUVlnY3lQYk9JZUkwbWFnTmhBSkJyOGJtc2ZOQ0NGR0YxRE1wa2pVQWN6T1RLbUMxWXhQWng4RStGdWwwRVBtd0JEem9QN1ZlbHhiNHZwSFlXT2VGTmFsWURNN2FHMUQra2ZCd09JQkZGZXZtN3JpMTVCUmtnMWJiVUNhSEdMZ3NGNmFKL0RkTzl0dkMxU2pmNUwwUkttRjBNUC9obzRvUUJjdVhtd1NjVGVJOWlCek9SdUZ5bjBMbTlYeVVGMGI3OFJ4SXAxS3I5Zlo1N3dQTk1CZ1FBSmV1VTFBaTR1SFZKWDdpMTRnVTg1TkVJZ1NqaFMvbEJNQmJFMWlrbDFtcmVPZ014S0N6V0Zjd0ZEUGdrL3JoRE5HQmVGbDNYQ1ZaS2E0NU10SHRRWmx6M0huOUV4b2pyYmRPTmFrcHdNVkRpZldKSHRMZU1rVWk4WU1CQXk0a3JJeDRETU1Kb0FGUGRkaDRzR1huc0x2cUtxUnM5dHFRRk9iOEVmMjJ6a25oczF5bUhlU3ZhQm8yU2xlRU5Ld1pkWFppcGl5WVkyQ2VWN053K1ZTaVBaZCthQ3pBPT0iLCJpc3N1ZXIiOiJkZW1vLmhleGFlaWdodC5jb20iLCJ0eXAiOiJKT1NFIiwiY2hhbm5lbFNlY3VyaXR5Q29udGV4dCI6IkhleGFFaWdodEVuY3J5cHRpb24iLCJpYXQiOjI3MTkwNzI2LCJleHAiOjI3MTkwNzU2fQ.eyJlbmNyeXB0ZWQiOiJqK0NuMEdDMEZGNFpyWThtL3pJMndNS1VqRXdGZTVuVFI0T0hqQmxHNFNQNFd0K29VdzFYR0lwNlVablhOdzFrZHpPelg0L2NEcXo0T2ZxYTM4YUZ6SURNRlFFckNGVjhaeTF1RTVDa3RBMUtPZjVlT0Fpc2JYRktPdEl2dXpSdGo5QU4wNGgwMWtZdTM1TWZBUXVRTEw0Z0NHSnN6UnN5ODNsVlg5TUppTXlBekpabDlES3Fzd2dtZjN1L3lLV3AvdGhnY3Q5YlhhWXlVN3BYa1Y5NFYxUnZlTUNLY1VxeFg1eDZwTjREdmFxOFMrVVp0MWk4RTAwR2RYelFLNURNZ015YVpQMVNwTjBsQmFkNVl0ZG9wVXBXTWxTZlJ0SVlQdExMdnRwS0tqMUNJcFhRN0k3NVdUVXhJWW9uM3VHOEpraHpCakNCYlhwWEVPeHBZWGlGeklETVpIYkpXTmhXN3dCQ2dtM1prM0FmTnowa3ZxYjB2ZzFVT0lmZm9CSXdpQUsySmFNdU9HYVNKM3VIWW5seGYzVU44MFNrbUJGaHdtQVkwWXBsaDh5QXpMbDJXSkR3YWRLUkZvMW1FRW5VTUZFenVyWUNnaHB4T1NDRXRoNCtsSEZOT3B0M3FVL0s2RmJxV3pLRnBZelRJTHgxeDlsamswYS9xbHpkeElmTWdNeUl4QThJZjVqdXBJeHpCeVhhdFhna1RSSzJvekpROGlVUFcrN0lrU3pmUnBEY2VMSjZkYWtSclZBWHVGYVZXRWpocStVRjM0b1dxWDNhMjNDT3pJRE1lc0RYTUdrVk5xVlpIRVZBbk5LUG93T1Uzd0dYSVBHb0xZcnkxZHpmQjF6UXBDNVZ6dDdJYnBrbDF5OS9DK2VFajNUeXM5ZHFMYjhNR25tdWo4eUF6SUxjK0phN21EYkVJMU8xUHJRa1RBRExLQUxiVlMzbVhGT0J5eTUyRUxKZ1ZtcGVRVENaNTYvQmE5MENhOE9XRWEwQklTMTBHbW8vK0FzL0JZN01nTXdHcWZGaG9SUTd0bExYVmE0dUZIKyt2bHRuT1BQUEhRQ29XRGpndklrL2RveVVQOVpxeTExd3Z4T0tZS3c0cjRyaUtoZGxqN2s3YWZJNTUwNkh6SURNbnM0QVFMN2ZuakNaR3lzSXpqenFIcXJkVHdTVWVmQWJvVTdla0xTTmRLNEF4ZEZVVlFVb2Zock4rQ3R5MVBoRjNSUUdzQ3M3TGdLSGhobGVqc3lBekU4aDMyQm1iZGx3ZlE4N1lyMEF3RG42endGQ1l6aTFJVXEvQUJnZUhmUllvVEtBZ3lOY2ZDS3JIZXJoemN6K0NNdXBHS3FQVE5GUFBhUDhXNGZNZ015dkhYeStBRXRzRFBWeWt0dkEzcEl4T2lad3BJaXVYb1EwZWdSVk1COTZrZEUvaUw1SzJQNXFCMFh3a21VTitnVXJwRkNQRUNJR1ZLRjQzQ2FJeklETSJ9.RQmHl3RwBCxE0wdu2An8JxiIF-bDvrJcxnkAda2IA-4

The above JSON web token was generated by a Resource Domain called demo.hexaeight.com and its intended recipient was resource.hexaeight.com. But if you decode the header, there is no information on the audience or the intended recipient.

If you are thinking it may be in the payload, the answer is yes, but the audience information is encrypted. This will make JSON Web Token resistant to attacks since the attacker will have no clue on the intended recipient of this JWT token.

HexaEight JWT created for a Recipient R by a Sender S using Sender's HexaEight Credentials can only be decrypted by the intended recipient R by using Recipient R own HexaEight Credentials.