如何为基于JWT Bearer Token认证的REST API的JWT Payload添加额外防护？

Great question—since JWT payloads are just base64url encoded (not encrypted), anyone who gets their hands on the token can decode it in seconds to see the raw data. If you need an extra layer of protection for your payload, here are practical, production-grade solutions to implement:

1. Use JSON Web Encryption (JWE) Instead of JWS #

JWTs are often referred to as JWS (JSON Web Signature), which only signs the payload to ensure integrity—but doesn’t encrypt it. JWE (JSON Web Encryption) takes this a step further by encrypting the entire payload, so even if someone intercepts the token, they can’t read the content without the decryption key.

Most popular JWT libraries support JWE out of the box. For example, in Node.js using the jose library:

import { EncryptJWT } from 'jose';
import { createSecretKey } from 'crypto';

// Your sensitive payload
const payload = { userId: 123, email: 'user@example.com', role: 'admin' };

// Generate a strong encryption key (store this securely, e.g., in a secrets manager)
const encryptionKey = createSecretKey(Buffer.from('your-256-bit-secret-key-here', 'utf8'), 'utf8');

// Create and encrypt the JWE token
const jweToken = await new EncryptJWT(payload)
  .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
  .setIssuedAt()
  .setExpirationTime('2h')
  .encrypt(encryptionKey);

// On the server side, decrypt the token to get the payload
// (using the same encryption key)

JWE is ideal when your entire payload contains sensitive information and you want full confidentiality.

2. Encrypt Individual Sensitive Fields in the Payload #

If you don’t need to encrypt the entire payload (e.g., you still want non-sensitive fields like exp or iss to be readable), you can encrypt only the sensitive fields within the payload.

For example, encrypt a user’s email or phone number using AES-GCM, then store the encrypted string and initialization vector (IV) in the payload:

import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';

const sensitiveData = 'user@example.com';
const key = randomBytes(32); // 256-bit key
const iv = randomBytes(12); // GCM recommended IV length

// Encrypt the sensitive field
const cipher = createCipheriv('aes-256-gcm', key, iv);
let encrypted = cipher.update(sensitiveData, 'utf8', 'base64');
encrypted += cipher.final('base64');
const authTag = cipher.getAuthTag().toString('base64');

// Add to JWT payload
const payload = {
  userId: 123,
  encryptedEmail: encrypted,
  iv: iv.toString('base64'),
  authTag: authTag,
  exp: Math.floor(Date.now() / 1000) + 7200
};

// On the server, decrypt the field using the key, iv, and authTag

This approach balances confidentiality and usability—you still get the benefits of JWT’s structured payload while protecting only the data that matters.

3. Avoid Storing Sensitive Data in JWT Payloads Entirely #

The most secure approach (when possible) is to not put sensitive data in JWT payloads at all. Instead, store sensitive information in your database, and only include a non-sensitive identifier (like a user ID) in the JWT.

When your API receives the token, you:

1. Verify the token’s signature to ensure it’s valid and unmodified.
2. Extract the user ID from the payload.
3. Fetch the sensitive data directly from your database using the user ID.

This way, even if the token is decoded, an attacker only gets a user ID—no sensitive information. It’s simpler to implement than encryption and reduces the risk of accidental data exposure.

4. Use a Hybrid Sign-Then-Encrypt Flow #

If you need both integrity (signature) and confidentiality (encryption), you can combine JWS and JWE:

1. First, sign your payload as a JWS to ensure it hasn’t been tampered with.
2. Then, encrypt the entire JWS token as the payload of a JWE.

This ensures that only parties with the decryption key can read the payload, and once decrypted, you can verify the signature to confirm the data hasn’t been altered.

内容的提问来源于stack exchange，提问作者Viorel Costiniu