JWT SSO Callback Security Update: Migrating from GET to POST Requests

Overview

From v13.1 build release, we have addressed a critical security vulnerability where sensitive user details could be exposed through URL query parameters when using the GET method for JWT SSO callback. To mitigate this risk, we have enforced the use of the POST method instead.

This enhancement ensures that sensitive information is no longer transmitted through the browser’s address bar, helping protect user sessions from unintended exposure and improving the overall security of JWT-based authentication.

Purpose of the Change

• Prevent sensitive information leakage during JWT SSO callbacks.
• Align with industry best practices for secure data transmission.
• Strengthen overall security by using HTTP POST, which transmits data in the request body rather than exposing it in the URL.

Previously, our JWT documentation recommended using the GET method, which resulted in user credentials and authentication data being passed through query strings. Such information could be exposed through browser history, server logs, monitoring tools, or third-party scripts.

Impact on Existing Users

Customers who have configured their JWT provider applications to use the GET method will experience a breaking change after upgrading to the latest version (below 15 version). Authentication attempts that rely on the previous configuration may fail until the integration is updated to use the POST method.

What You Need to Do

1. Update Your Callback Endpoint
   • Update your JWT provider application to send authentication tokens using the POST method.
2. Pass JWT Data in the Request Body
   • Modify your implementation to send the following parameters in the POST request body instead of URL query parameters:
     • jwt
     • site_identifier
     • redirect_to

Refer to the updated JWT configuration documentation for implementation guidance.

3. Update Identity Provider (IdP) Configuration
   • If you are using a third-party Identity Provider (IdP), update the callback configuration to use the POST method instead of GET.
4. Validate the Integration
   • Perform a complete SSO login flow.
   • Verify that the JWT token is successfully received and processed.
   • Review application and server logs for any authentication errors or configuration issues.