Securing REST APIs: OAuth2 vs JWT Weaknesses

Abstract

With the ongoing digital transformation, modern software applications are increasingly using REST APIs to facilitate communications among distributed systems, mobile apps, and cloud services, turning API security into one of the most pressing issues in the digital world today. Since APIs are a common route to access sensitive data and key functionalities, improper controls of their authentication and authorization mechanisms can be exploited to cause serious damages. OAuth2 and JSON Web Tokens (JWT) are arguably two of the most popular technologies by which REST APIs can be safeguarded; consequently, they have set the standard for the industry because of their scalability and flexibility. OAuth2 sets up an authorization delegation architecture under which a client can be given access without having to expose the credentials, whereas the JWT functions as a compact, self-contained token carrier of the claims between two parties. Due to the fact that they have been adopted en masse, it might be assumed that they do not have any security risks, however, if for some reason the design, configuration or implementation are done incorrectly, they will each have a market share of such risks. The paper documents the main security failures of OAuth2 and JWT to token leakages, insufficient token validations, insecure token storages, over-privileged scopes, replay attacks, and algorithm-related vulnerabilities. An extensive exposure of OAuth2 and JWT on various aspects of security such as confidentiality, integrity, token lifecycle management, and attack surface is done through a comparative analysis methodology. Besides, a case study of the real world is incorporated to expose the impact of some common misconfiguration and design choices in security frameworks otherwise thought to be strong. It is demonstrated that the major problems are not the result of the standards themselves but rather the misuse of developers, lack of threat modeling and inadequate enforcement of best practices. This paper sheds light on the security weaknesses of OAuth2 and JWT, depicts the real risks faced by REST APIs today, and provides some guidance towards better decision making from the security point of view by architects and developers in the selection and implementation of API authentication strategies.