Using JWT to authenticate a user with an external system?

A recent comment brought my attention to this question, which I had posted. I had also posted another question regarding this topic, and had later solved it and posted an answer, here: JWT authentication with WP – Approach

Copying that answer here, so that it helps someone who stumbles across this implementation:

  1. The endpoint coded in the app that I am supposed to authenticate with prepares the token.
  2. The token has to be in the specified format.
  3. It then should be base 64 encoded and hash encrypted.
  4. The wp_init handler should be used to handle the POST request sent by the endpoint, to extract the token.
  5. The key will be shared via some other way, used for decryption.
  6. Once the token is extracted, compare it against a locally generated token with the same information.
  7. Store it in a cookie, and check it on every page access. You can expire it after a while or keep on increasing the time slice on every page access.

The endpoint could be in any language. Also this is the general flow of it, you can use it anywhere you want.

Leave a Comment