How to add JWT to authorization header?
Solution 1
So, You are pretty much correct with JWT. All you need to do when sending data from client to server (after JWT creation), is to add it to the request header. Many folks will try to keep along the same path as OAuth and add a Bearer token similar to the node snippet below:
var rp = require('request-promise');
options = {
method: GET,
uri: 'https://www.example.com/api/sample',
headers: {
Authorization: "Bearer <insert_your_JWT_here>"
}
}
rp(options).then(function(res){
<handle_response>
}
Granted I know you mentioned PHP, but the workflows are the same, its just the syntax is different.
Now, to verify that this token is present, the server would need to verify() that the token is valid with the secret that was defined. In every request made by the client, for an authorized endpoint, you would need to send this token everytime.
Solution 2
The user above was asking for a BROWSER-BASED means of settings authorization headers, or headers at ALL, for that matter.
(Node.js runs on the server. I realize that the accepted answer above refers to a SERVER authenticating to ANOTHER SERVER, and that the responder calling this "the client side code" is technically correct, with respect to server-to-server communication following the client-server model of who is requesting authorization with whom, but this does not address the true question: how does a browser modify it's authorization header to include a stored token etc.
Aside from the html href, which does not provide a means of accessing or altering headers sent, there are javascript means of sending requests. One can use a standard XHR to demonstrate how one sets the headers via javascript
xhr.open('GET', url, true);
xhr.setRequestHeader("Authorization", "Bearer " + yourtoken);
xhr.send();
Note: There should be a space after the Bearer
keyword.
You may be able to find php-templated means of inscribing the token into the rendered page (hidden element?) but javascript running in the browser provides the means for manipulating the request headers. It's worth noting that cookies are automatically sent on all requests for a given domain, while local/session storage requires manually setting them usually.
Comments
-
michael-mammut over 2 years
As described in the following slide, it is necessary that the client sends the
jwt
back to the server by anAuthorization Header
at the next request.But how can I define the
Authorization Header
and add the JWT to the server?My current status is:
- User sends
username
andpassword
to the server by aPOST
request. - The server creates the the
JWT
. - The server sends the signed
JWT
back to the client and saves it in a cookie.
Now my questions:
-
In case of a Login:
As I understand it, now its necessary to send the JWT back to the server. The server verifies the token and sends it back to finish the login process.
How can I add the
JWT
to theAuthorization Header
? -
In case of running a process and receiving data from a calculation:
Do I understand right, that the client has to send the
JWT
from the login to the server and a secondJWT
with the data; or can I send the data byPOST
request?
- User sends
-
michael-mammut over 7 yearsAs is understand, your code snipped is from the server side? Is this right?
-
LostJon over 7 yearsThe snippet i showed is from the client. In my response, the server would be uri = example.com/api/sample
-
michael-mammut over 7 yearsok, so it is correct to say: i have to create the process to send the
authentication header
as aBearer
back to the server is to create on the client ( maybe with angularJS ) ? -
LostJon over 7 yearssounds right....and depending on how your server interprets the token, it can be Bearer or whatever keyword you used. Any JS framework can modify request headers before send.
-
LostJon over 7 yearsMake sure that if this is an ok answer, to mark as the answer; or feel free to ask if you are still confused.