The Problem: Sensitive Data in JWTs
When you use JWT (JSON Web Tokens) for authentication, the payload contains user information like the user ID or email. However, since JWTs are base64-encoded and can be easily decoded, this exposes your sensitive data to potential security risks.
Example:
If someone intercepts your JWT, they can easily read the user’s email, user ID, and any other personal information you might have stored in the payload. This could lead to data leaks or unauthorized access to sensitive user data.
Solution: Ghost Tokens
What is a Ghost Token?
A Ghost Token is a creative and secure solution that prevents the exposure of sensitive data in JWTs. Instead of directly storing sensitive information (like user IDs or emails) in the token, you store a “ghost value” — a non-sensitive, random, or hashed reference. This reference is linked to the actual sensitive data on your server.
How Does It Work?
- The token contains a “ghost reference” (a hashed value or unique identifier), but not the actual user data.
- On the server-side, the actual sensitive information (like email, user ID) is stored securely in your database or a secure cache.
- When the token is sent to the server, it is used to retrieve the actual user data using this “ghost reference” — without exposing the sensitive data in the token itself.
Why Use Ghost Tokens?
1. No Sensitive Data in JWT Payloads
Since the token only holds a reference and not any personal data, your sensitive user information stays safe and secure on your server, reducing the risk of leaks.
2. Easily Rotatable and Revocable Tokens
If you need to invalidate a token, simply remove or rotate the reference (ghost value) from your database. This makes managing user sessions simple and efficient without exposing sensitive information.
3. Lightweight Tokens
Since the payload only contains a reference, Ghost Tokens are smaller, leading to better performance both on the client and server-side.
4. Enhanced Security
Even if an attacker intercepts the token, they can’t access the sensitive data because only the server can resolve the “ghost” reference to the real data. This creates an additional layer of security.
How It Works - A High-Level Overview
- User Authentication
When a user logs in, the system generates a Ghost Token by storing a non-sensitive reference in the payload (like a hashed user ID). - Secure Server-Side Storage
On the backend, the sensitive data (e.g., user ID, email) is stored securely, usually in a database or cache. - Using the Token
The user’s app sends the Ghost Token in requests (typically in the Authorization header). - Server Resolves the Ghost Token
When the server receives the token, it looks up the reference in its secure storage and retrieves the sensitive user data. - Data Use & Response
Now the server can use the real user data to perform actions, but the data is never exposed in the token.
Why It’s a Perfect Fit for Serverless & Scalable Apps
If you’re using serverless functions (e.g., Firebase Functions) or cloud-based platforms, managing background tasks and ensuring security can become tricky. Ghost Tokens fit perfectly into these environments because:
- No need to store sensitive data in the token
- The token can be easily invalidated or rotated without affecting user data.
- It’s scalable: As your app grows, it can handle more users and events securely.
The Advantages of Ghost Tokens
- Privacy Protection
Sensitive data never leaves the server in the token, so even if a token is compromised, the actual data remains hidden. - Efficient
You don’t need to send or store large amounts of data in each token. Just a small reference can achieve the same result! - Improved Token Management
Tokens are easier to manage (invalidate, rotate) because they don’t contain any sensitive data. - Enhanced User Experience
Without bloated tokens, you reduce latency and make your app more responsive for users.
Real-World Application
Imagine a scenario in your app where users log in, and you generate a Ghost Token. Instead of sending the user’s email or ID in the JWT payload, you store just a hashed reference to their data.
When the app needs to retrieve the user’s info, it sends the Ghost Token to the server. The server then uses this token to look up the real data — but since the sensitive data isn’t in the token, you’ve secured the user’s information, making your system much more robust.
Takeaway
If you’re building an app that handles sensitive user information, Ghost Tokens with JWT offer a secure, lightweight, and scalable solution. By keeping the real data on the server and only passing around a reference, you significantly improve your app’s security posture, performance, and manageability.
In conclusion, Ghost Tokens are an essential pattern to protect your user’s privacy and secure your app, especially when using JWT-based authentication!