HexaEightJWTLibrary 1.9.6

HexaEight JWT Library

How To Use The Library

Visit HexaEight For More Information

Code Sample

Initialization

var newjwt = new HexaEightJose.JWT();

newjwt.Initialize();

Set HexaEight Resource Name via CommandLine

newjwt.Setresourcename();

Set HexaEight Resource LoginToken via CommandLine

newjwt.Setlogintoken();

Set HexaEight Resource LoginToken Credential via CommandLine

newjwt.Setpassword();

Set Rapid API Key via CommandLine

newjwt.Setapikey();

Once the above is set, an encrypted JWT as shown in the below sample can be generated for any destination resource.

newjwt.AddPayloadItem("aud", destinationresourcename);

newjwt.AddPayloadItem("clientxmlpubkey", xmlpublickey);

newjwt.AddPayloadItem("user", "anyuser@somedomain.com");

newjwt.AddPayloadItem("sessionid", sessionid);

newjwt.AddPayloadItem("sessionpassword", sessionpassword);

newjwt.AddPayloadItem("tokentype", "AccessToken");

Set the JWT token expiration in minutes.

var encryptedtoken = newjwt.CreateEncryptedJWTToken(resource, 1440);

At the Destination resource, Initialize and Set HexaEight Destination resource credentials and decrypt the token using the below command.

var decryptedaccesstoken = newjwt.ValidateToken(encryptedtoken);

Added Support for Managing JWT Sessions - New in Version 1.7.5

Added Support for Creating Simple JWT without HexaEight Encryption but using a Symmetric Password - New in Version 1.8.1

Added Support for HexaEight Client Encryption using JWT - New in Version 1.8.6

Added Authentication Functions for Clients - New in Version 1.8.7

1. Initiate Login Process For Client Application.

var clientjwt = new HexaEightJose.JWT(); var tokenserverurl = "http://localhost:5000"

var clientcode = clientjwt.InitiateLoginProcess("http://localhost:5000/api/fetch-client-code", clientid);

2. Fetch Login QR Code (Capture a password for the session from the user and use the password to fetch the QRCode)

Console.Write("Enter a strong password to secure this Client Session : ");

var clientpassword = clientjwt.ReadPassword();

var qrcoderesp = clientjwt.FetchLoginQRCode(clientcode, clientpassword);

3. Display the Login QR Code to Process the user authentication.

clientjwt.DisplayLoginQRCode(qrcoderesp);

4. Fetch the JWT Token containing the user identity

var jwttoken = clientjwt.FetchLoginToken(qrcoderesp, clientpassword);

5. Fetch Logged In User

var loggedinuser = clientjwt.FetchLoggedInUserUsingLoginToken(jwttoken);

6. Fetch The Application Name

var appname = clientjwt.FetchAppNameUsingLoginToken(jwttoken);

7. Fetch The Resource ID

var resourcename = clientjwt.FetchResourceIdentityUsingLoginToken(jwttoken);

8. Retrieve Client Specific Asymmetric Shared Key (ASK) For any destination user or resource.

var destinationask = clientjwt.RetrieveASKFromTokenAuthzServer(jwttoken, someone@domain.com, clientid, tokenserverurl);

9. Use the Client Specific Asymmetric Shared Key (ASK) To Encrypt Message For the destination.

var hellomsg = "Hello Someone...";

var encryptclientspecificmsg = clientjwt.HEClient.EncryptMessageUsingUAK(jwttoken, someone@domain.com, hellomsg, destinationask);

10. Use the Client Specific Asymmetric Shared Key (ASK) To Decrypt any Client specific message received from destination using the ASK (fetched using step 8)

var encryptedmessage = "eyJhbGciOiJIUzI1NiIsImtpZCI6IjU2TX..."; (Usually recieve a JWT Message)

var decryptedclientspecificmsg = clientjwt.ValidateTokenUsingSharedKey(encryptedmessage, destinationask);

console.WriteLine(decryptedclientspecificmsg);

Latest Version contains breaking changes and major bug fixes - 1.9.5

Below is a a sample JWT which uses HexaEight Encryption generated using HexaEight JWT Library. The contents of this JSON Web Token can be verified from https://jwt.io

eyJhbGciOiJIUzI1NiIsImtpZCI6IjU2TXNjdXdNRlM4dFJ6VURLQ2dlbXpLYkJvcGRVRzlxYno5K2dFcFdWMzExQ3NTSW1aTGVKdUpMSWwwN2VraUpabG9QbHJCbWk1TWFlK3FTVnNtMm80RE1rUjZqS3VvYVhYdDlTeWxuK2tZSkVDZzZkVkV6WmtBcVF4SXZFRjRMS1J3d1FTTXVsR2Y5QkpJcjdUYjRsSFJkQ1NhaEFPcEt2WldMb0JhRVFpQ0N6SDhuWUFOaUhRTU9KNWNObm5vVitFMzRoUkpZZzVieGV0OVBTb2lRUEtBaTYwTTZZcHRKa3lsN1J1WlZlSHZlSTdOeDhYSjZXZk1neGx5ZlVwUVlnY3lQYk9JZUkwbWFnTmhBSkJyOGJtc2ZOQ0NGR0YxRE1wa2pVQWN6T1RLbUMxWXhQWng4RStGdWwwRVBtd0JEem9QN1ZlbHhiNHZwSFlXT2VGTmFsWURNN2FHMUQra2ZCd09JQkZGZXZtN3JpMTVCUmtnMWJiVUNhSEdMZ3NGNmFKL0RkTzl0dkMxU2pmNUwwUkttRjBNUC9obzRvUUJjdVhtd1NjVGVJOWlCek9SdUZ5bjBMbTlYeVVGMGI3OFJ4SXAxS3I5Zlo1N3dQTk1CZ1FBSmV1VTFBaTR1SFZKWDdpMTRnVTg1TkVJZ1NqaFMvbEJNQmJFMWlrbDFtcmVPZ014S0N6V0Zjd0ZEUGdrL3JoRE5HQmVGbDNYQ1ZaS2E0NU10SHRRWmx6M0huOUV4b2pyYmRPTmFrcHdNVkRpZldKSHRMZU1rVWk4WU1CQXk0a3JJeDRETU1Kb0FGUGRkaDRzR1huc0x2cUtxUnM5dHFRRk9iOEVmMjJ6a25oczF5bUhlU3ZhQm8yU2xlRU5Ld1pkWFppcGl5WVkyQ2VWN053K1ZTaVBaZCthQ3pBPT0iLCJpc3N1ZXIiOiJkZW1vLmhleGFlaWdodC5jb20iLCJ0eXAiOiJKT1NFIiwiY2hhbm5lbFNlY3VyaXR5Q29udGV4dCI6IkhleGFFaWdodEVuY3J5cHRpb24iLCJpYXQiOjI3MTkwNzI2LCJleHAiOjI3MTkwNzU2fQ.eyJlbmNyeXB0ZWQiOiJqK0NuMEdDMEZGNFpyWThtL3pJMndNS1VqRXdGZTVuVFI0T0hqQmxHNFNQNFd0K29VdzFYR0lwNlVablhOdzFrZHpPelg0L2NEcXo0T2ZxYTM4YUZ6SURNRlFFckNGVjhaeTF1RTVDa3RBMUtPZjVlT0Fpc2JYRktPdEl2dXpSdGo5QU4wNGgwMWtZdTM1TWZBUXVRTEw0Z0NHSnN6UnN5ODNsVlg5TUppTXlBekpabDlES3Fzd2dtZjN1L3lLV3AvdGhnY3Q5YlhhWXlVN3BYa1Y5NFYxUnZlTUNLY1VxeFg1eDZwTjREdmFxOFMrVVp0MWk4RTAwR2RYelFLNURNZ015YVpQMVNwTjBsQmFkNVl0ZG9wVXBXTWxTZlJ0SVlQdExMdnRwS0tqMUNJcFhRN0k3NVdUVXhJWW9uM3VHOEpraHpCakNCYlhwWEVPeHBZWGlGeklETVpIYkpXTmhXN3dCQ2dtM1prM0FmTnowa3ZxYjB2ZzFVT0lmZm9CSXdpQUsySmFNdU9HYVNKM3VIWW5seGYzVU44MFNrbUJGaHdtQVkwWXBsaDh5QXpMbDJXSkR3YWRLUkZvMW1FRW5VTUZFenVyWUNnaHB4T1NDRXRoNCtsSEZOT3B0M3FVL0s2RmJxV3pLRnBZelRJTHgxeDlsamswYS9xbHpkeElmTWdNeUl4QThJZjVqdXBJeHpCeVhhdFhna1RSSzJvekpROGlVUFcrN0lrU3pmUnBEY2VMSjZkYWtSclZBWHVGYVZXRWpocStVRjM0b1dxWDNhMjNDT3pJRE1lc0RYTUdrVk5xVlpIRVZBbk5LUG93T1Uzd0dYSVBHb0xZcnkxZHpmQjF6UXBDNVZ6dDdJYnBrbDF5OS9DK2VFajNUeXM5ZHFMYjhNR25tdWo4eUF6SUxjK0phN21EYkVJMU8xUHJRa1RBRExLQUxiVlMzbVhGT0J5eTUyRUxKZ1ZtcGVRVENaNTYvQmE5MENhOE9XRWEwQklTMTBHbW8vK0FzL0JZN01nTXdHcWZGaG9SUTd0bExYVmE0dUZIKyt2bHRuT1BQUEhRQ29XRGpndklrL2RveVVQOVpxeTExd3Z4T0tZS3c0cjRyaUtoZGxqN2s3YWZJNTUwNkh6SURNbnM0QVFMN2ZuakNaR3lzSXpqenFIcXJkVHdTVWVmQWJvVTdla0xTTmRLNEF4ZEZVVlFVb2Zock4rQ3R5MVBoRjNSUUdzQ3M3TGdLSGhobGVqc3lBekU4aDMyQm1iZGx3ZlE4N1lyMEF3RG42endGQ1l6aTFJVXEvQUJnZUhmUllvVEtBZ3lOY2ZDS3JIZXJoemN6K0NNdXBHS3FQVE5GUFBhUDhXNGZNZ015dkhYeStBRXRzRFBWeWt0dkEzcEl4T2lad3BJaXVYb1EwZWdSVk1COTZrZEUvaUw1SzJQNXFCMFh3a21VTitnVXJwRkNQRUNJR1ZLRjQzQ2FJeklETSJ9.RQmHl3RwBCxE0wdu2An8JxiIF-bDvrJcxnkAda2IA-4

The above JSON web token was generated by a Resource Domain called demo.hexaeight.com and its intended recipient was resource.hexaeight.com. But if you decode the header, there is no information on the audience or the intended recipient.

If you are thinking it may be in the payload, the answer is yes, but the audience information is encrypted. This will make JSON Web Token resistant to attacks since the attacker will have no clue on the intended recipient of this JWT token.

HexaEight JWT created for a Recipient R by a Sender S using Sender's HexaEight Credentials can only be decrypted by the intended recipient R by using Recipient R own HexaEight Credentials.