Web API 2 authentication with JWT

Question

Please review my code for bearer token (JWT) authentication of Web API 2 (Self Hosted using OWIN)

Are there any security issues in the implementation?

Quick overview:

• Token creation and validation using JWT Handler
• Symmetric key encryption
• CORS support not yet checked for the authorization header
• Web traffic will be on SSL.
• The key cannot be auto-generated as it will break during a load balanced scenario. Can I save the key in config? Or switch to X509 certificates?

This is the main class to create and validate tokens:

public class TokenManager
{
 public static string CreateJwtToken(string userName, string role)
 {
 var claimList = new List<Claim>()
 {
 new Claim(ClaimTypes.Name, userName),
 new Claim(ClaimTypes.Role, role) //Not sure what this is for
 };
 var tokenHandler = new JwtSecurityTokenHandler() { RequireExpirationTime = true };
 var sSKey = new InMemorySymmetricSecurityKey(SecurityConstants.KeyForHmacSha256);
 var jwtToken = tokenHandler.CreateToken(
 makeSecurityTokenDescriptor(sSKey, claimList));
 return tokenHandler.WriteToken(jwtToken);
 }
 public static ClaimsPrincipal ValidateJwtToken(string jwtToken)
 {
 var tokenHandler = new JwtSecurityTokenHandler() { RequireExpirationTime = true };
 // Parse JWT from the Base64UrlEncoded wire form 
 //(<Base64UrlEncoded header>.<Base64UrlEncoded body>.<signature>)
 JwtSecurityToken parsedJwt = tokenHandler.ReadToken(jwtToken) as JwtSecurityToken;
 TokenValidationParameters validationParams =
 new TokenValidationParameters()
 {
 AllowedAudience = SecurityConstants.TokenAudience,
 ValidIssuer = SecurityConstants.TokenIssuer,
 ValidateIssuer = true,
 SigningToken = new BinarySecretSecurityToken(SecurityConstants.KeyForHmacSha256),
 };
 return tokenHandler.ValidateToken(parsedJwt, validationParams);
 }
 private static SecurityTokenDescriptor makeSecurityTokenDescriptor(
 InMemorySymmetricSecurityKey sSKey, List<Claim> claimList)
 {
 var now = DateTime.UtcNow;
 Claim[] claims = claimList.ToArray();
 return new SecurityTokenDescriptor
 {
 Subject = new ClaimsIdentity(claims),
 TokenIssuerName = SecurityConstants.TokenIssuer,
 AppliesToAddress = SecurityConstants.TokenAudience,
 Lifetime = new Lifetime(now, now.AddMinutes(SecurityConstants.TokenLifetimeMinutes)),
 SigningCredentials = new SigningCredentials(sSKey,
 "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256",
 "http://www.w3.org/2001/04/xmlenc#sha256"),
 };
 }
}

I have a message handler to intercept the requests and I verify the validity of token except for the route for log in, using TokenManager.ValidateJwtToken() above.

To create the token, in the LoginController, I have the following code:

[Route("login")]
[HttpPost]
public HttpResponseMessage Login(LoginBindingModel login)
{
 if (login.Username == "admin" && login.Password == "password") //Do real auth
 {
 string role = "Librarian";
 var jwtToken = TokenManager.CreateJwtToken(login.Username, role);
 return new HttpResponseMessage(HttpStatusCode.OK)
 {
 Content = new ObjectContent<object>(new
 {
 UserName = login.Username,
 Roles = role,
 AccessToken = jwtToken
 }, Configuration.Formatters.JsonFormatter)
 };
 }
 return new HttpResponseMessage(HttpStatusCode.BadRequest);
}

The full working code is available here and the instructions to run the sample are in the Wiki.

Answer 1

Instead of keeping KEY in config, I would keep it with user records. A unique key for each user.

I admit, I don't get why creating keys dynamically would break the load balancing scenario. We can have a key created at the back-end where we have a single service serving all the load balances servers (such as a database).