Skip to content

Commit 341e423

Browse files
patriciasantaanapatriciasantaana
committed
jwt validation
1 parent 7be827d commit 341e423

File tree

1 file changed

+60
-23
lines changed
  • src/content/docs/api-shield/security/jwt-validation

1 file changed

+60
-23
lines changed

‎src/content/docs/api-shield/security/jwt-validation/index.mdx‎

Lines changed: 60 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ sidebar:
66

77
---
88

9-
import { GlossaryTooltip, Steps } from "~/components"
9+
import { GlossaryTooltip, Steps, Tabs, TabItem } from "~/components"
1010

1111
<GlossaryTooltip term="JSON web token (JWT)">JSON web tokens (JWT)</GlossaryTooltip> are often used as part of an authentication component on many web applications today. Since JWTs are crucial to identifying users and their access, ensuring the token’s integrity is important.
1212

@@ -20,35 +20,72 @@ A JWT validation configuration consists of creating a token validation configura
2020

2121
### Add a token validation configuration
2222

23-
<Steps>
24-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain.
25-
2. Go to **Security** > **API Shield** > **Settings**.
26-
3. Under **JSON Web Token Settings**, select **Add configuration**.
27-
4. Add a name for your configuration.
28-
5. Choose where Cloudflare can locate the JWT for this configuration on incoming requests, such as a header or cookie and its name.
29-
6. Copy and paste your JWT issuer's public key(s) (JWKS).
30-
</Steps>
23+
<Tabs syncKey="dashNewNav">
24+
<TabItem label="Old dashboard">
25+
<Steps>
26+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain.
27+
2. Go to **Security** > **API Shield** > **Settings**.
28+
3. Under **JSON Web Token Settings**, select **Add configuration**.
29+
4. Add a name for your configuration.
30+
5. Choose where Cloudflare can locate the JWT for this configuration on incoming requests, such as a header or cookie and its name.
31+
6. Copy and paste your JWT issuer's public key(s) (JWKS).
32+
</Steps>
33+
</TabItem>
34+
<TabItem label="New dashboard" icon="rocket">
35+
<Steps>
36+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain.
37+
2. Go to **Security** > **Settings**.
38+
3. Filter by **API abuse**.
39+
4. On **Token configurations**, select **Configure tokens**.
40+
5. Add a name for your configuration.
41+
6. Choose where Cloudflare can locate the JWT for this configuration on incoming requests, such as a header or cookie and its name.
42+
7. Copy and paste your JWT issuer's public key(s) (JWKS).
43+
</Steps>
44+
</TabItem>
45+
</Tabs>
3146

3247
Each JWT issuer typically publishes public keys (JWKS) for verification at a known URL on the Internet. If you do not know where to get them, contact your identity administrator.
3348

3449
To automatically keep your JWKS up to date when your identity provider refreshes them, you can use a Worker. Refer to [Configure Workers to automatically update keys](/api-shield/security/jwt-validation/jwt-worker/) to learn more about setting up the Worker.
3550

3651
### Add a JWT validation rule
3752

38-
<Steps>
39-
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain.
40-
2. Go to **Security** > **API Shield** > **API Rules**.
41-
3. <a id="rule-form"/>
42-
Add a name for your rule.
43-
4. Select a hostname to protect requests with saved endpoints using the rule.
44-
5. Deselect any endpoints that you want JWT validation to ignore (for example, an endpoint used to generate a JWT).
45-
6. Select the token validation configuration that corresponds to the incoming requests.
46-
7. Choose whether to strictly enforce token presence on these endpoints.
47-
- You may not expect 100% of clients to send in JWTs with their requests. If this is the case, choose *Ignore*. JWT validation will still validate JWTs that are present.
48-
- You may otherwise expect all requests to the selected hostname and endpoints to contain JWTs. If this is the case, choose *Mark as non-compliant*.
49-
8. Choose an action to take for non-compliant requests. For example, JWTs that do not pass validation (expired, tampered with, or bad signature tokens) or requests with missing JWTs when *Mark as non-compliant* is selected in the previous step.
50-
9. Select **Save**.
51-
</Steps>
53+
54+
<Tabs syncKey="dashNewNav">
55+
<TabItem label="Old dashboard">
56+
<Steps>
57+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain.
58+
2. Go to **Security** > **API Shield** > **API Rules**.
59+
3. <a id="rule-form"/>
60+
Add a name for your rule.
61+
4. Select a hostname to protect requests with saved endpoints using the rule.
62+
5. Deselect any endpoints that you want JWT validation to ignore (for example, an endpoint used to generate a JWT).
63+
6. Select the token validation configuration that corresponds to the incoming requests.
64+
7. Choose whether to strictly enforce token presence on these endpoints.
65+
- You may not expect 100% of clients to send in JWTs with their requests. If this is the case, choose *Ignore*. JWT validation will still validate JWTs that are present.
66+
- You may otherwise expect all requests to the selected hostname and endpoints to contain JWTs. If this is the case, choose *Mark as non-compliant*.
67+
8. Choose an action to take for non-compliant requests. For example, JWTs that do not pass validation (expired, tampered with, or bad signature tokens) or requests with missing JWTs when *Mark as non-compliant* is selected in the previous step.
68+
9. Select **Save**.
69+
</Steps>
70+
</TabItem>
71+
<TabItem label="New dashboard" icon="rocket">
72+
<Steps>
73+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/login), and select your account and domain.
74+
2. Go to **Security** > **Security rules**.
75+
3. On API JWT validation rules, select **Create rule**.
76+
4. <a id="rule-form"/>
77+
Add a name for your rule.
78+
5. Select a hostname to protect requests with saved endpoints using the rule.
79+
6. Deselect any endpoints that you want JWT validation to ignore (for example, an endpoint used to generate a JWT).
80+
7. Select the token validation configuration that corresponds to the incoming requests.
81+
8. Choose whether to strictly enforce token presence on these endpoints.
82+
- You may not expect 100% of clients to send in JWTs with their requests. If this is the case, choose *Ignore*. JWT validation will still validate JWTs that are present.
83+
- You may otherwise expect all requests to the selected hostname and endpoints to contain JWTs. If this is the case, choose *Mark as non-compliant*.
84+
9. Choose an action to take for non-compliant requests. For example, JWTs that do not pass validation (expired, tampered with, or bad signature tokens) or requests with missing JWTs when *Mark as non-compliant* is selected in the previous step.
85+
10. Select **Save**.
86+
</Steps>
87+
</TabItem>
88+
</Tabs>
5289

5390
:::note
5491

0 commit comments

Comments
 (0)