[TIP] Apache module to authenticate a NativeSPApacheConfig to the backend app and sign attributes

[Cantor, Scott]

> (I can't quickly find this recommendation in writing,
> but it's the consensus I've gathered from research and presentations on
> JWTs.)  Encrypting the traffic between processes isn't really a JWT concern
> anyway, as if confidentially is needed between the proxy and the backend
> server then that should be set up regardless of using JWTs or not.  So
> connection encryption and confidentiality is something that would need to
> be taken into account and resolved regardless of using
> mod_proxy_jwt_auth.

The community in question is allergic to crypto to begin with, but the same spec that governs signing JSON addresses encryption (JOSE). You can't have meaningful confidentiality with a transport layer channel unless you bind the channel to the authentication that's done, otherwise you're open to MITM attacks. Message encryption is important in most scenarios that involve message signing/authentication.

Cool work, BTW.

-- Scott