JSON Web Token Leakage Avoidance Using Token Split and Concatenate in RSA256

Abstract

This research aims to protect users from JWT (JSON Web Token) leakage, which is listed plainly in the Response Header in the web browser console. The risk of malicious attackers stealing the JWT is highly dangerous since the API (Application Programming Interface) will be within the control of malicious attackers, leading to identity theft and data abuse due to the JWT leakage. As a solution, this paper proposed a method in which the JWT bearer token will be split, separately encrypted by RSA256, and concatenated into a new unique token to limit attacker accessibility towards the JWT token. The benefit of this proposed method is envisaged to achieve a more secure web application for user data protection and security optimization. The idea of this method is to modify the bearer token by splitting, encrypting, and concatenating it to be a unique token. The product of the encryption process is an unrecognizable token in the form of letters and punctuation which attackers cannot manipulate. The encrypted code will be returned to the initial location in Response Header. After testing, it is proven that modifying the bearer token by splitting and concatenating provides more security to a web application.