Is this approach for sending transparent parameters instead of an encrypted token by URL? In case I want an opaque token by URL, could I use only the encryption part without singing? Any contra-indication?
Tks!
julismz
tangui
Definitely not a good idea unless you know all the details of the crypto you are using. One of the neat example given is that, in some cases (depends on the encryption algorithm chosen, IV, etc.) an attacker could change the ID in your encrypted token.
Feel free to tell more about what you’re trying to achieve. But the rule of thumb is: stick to the standard, that is sign-then-encrypt.
0
julismz
enkr1
Hi @tangui,
I am trying to do a similar case where I only have the public key and I would like to verify the JWT before using it.
I am stuck at the verifying stage, I have created a post for help How to verify RS256 JWT with Joken.Signer.verify/2 - 2022
0