Web Tokens

About Web Tokens:

A JSON Web Token (JWT) is an industry standard defined in RFC 7519 as a compact and self-contained way to create access tokens for securely transferring information between two parties. When a user logs in to an authentication server with their credentials, a Web Token is returned. When this same user makes API calls to an application, the application uses the Web Token to authenticate the user attempting to access protected resources.

Creating a Web Token:

Register Site24x7 with your authentication server to monitor protected websites and endpoint APIs using Web Tokens. To set up monitoring, follow the steps below:

1. Log in to Site24x7.
2. Navigate to Admin > Configuration Profiles > Web Tokens.
   
3. Click Add Web Tokens.
4. You'll be prompted with an Add Web Token form.
5. Specify the following details:

• • Web Token name: Provide a Web Token name that will be used to authenticate the API endpoints.
  • Refresh interval: The Web Token is refreshed after the specified time interval by querying the endpoint URL.
  • Web Token endpoint URL: Specify the URL of the endpoint of your authentication server.
  • HTTP method: Specify the method to be used for connecting with the webpage– POST or GET. Use the radio buttons to configure the form submission method and appropriate body type for the POST HTTP method.
  • HTTP request headers: There are times you may want to customize the default HTTP request header information. In such cases, the additional header name and value can be added here.
  • Credentials: Specify your username and password for URLs requiring Basic/NTLM-based authentication.                                                                                                                                                            
  • Authenticated request method: Choose the method used to submit Web Tokens for authenticating API endpoints. Pick and define the method to pass the access Token. You can always use customized nomenclatures in the parameter fields.  
    • Request header: The access token is sent as the request header. Send the bearer token in the following name-value syntax: 
      

         "Authorization: Bearer ${access.token}"

    • URI query parameter: You can send the access token in the URI query parameter using the following syntax:          

          "access_token=${access.token}"

• • • Token Extraction: The token value in the response is extracted and can be further used to customize request parameters, headers, and more for other monitor  types where authentication is needed in the request URI.
      • Response format: Extract values from the Web Token as regular expressions, JSONPath expressions, or XPath expressions based on the chosen format: Text, XML, or JSON.
      • Web Token refresh failure alert: Choose a user alert group to receive notification when a Web Token refresh fails three consecutive times.
      • A Sample Webtoken Response:
        
           {
            "access_token": "XXXXXXX",
            "token_type": "bearer",
            "expires_in": 3599,
            "refresh_token": "YYYYYYY",
            ".issued": "Mon, 20 Jan 2020 09:39:44 GMT",
            ".expires": "Mon, 20 Jan 2020 10:39:44 GMT"
            }
        
        
        '$.access_token' is the Json Expression for fetching the token from the response.