# # Security

FoxitPDFSDKforWeb Server adopts JSON Web Token (jwt) type to authenticate the user access. Your Authentication Server generates a token that certifies the user identity, and sends it to Foxit client web viewer. The web viewer will send the token back to FoxitPDFSDKforWeb Server to let the server know this particular identity has the permission to the access certain documents.

You may refer to jwt.io
(opens new window) for how to generate JWT token.

Currently, FoxitPDFSDKforWeb Server only recognizes the 'exp (expiration time)' claim specified inside the JWT. Once the token is on or after this `exp` value, the request with this token becomes invalid, and not be accepted or processed.

## # Enable JWT validation on FoxitPDFSDKforWeb server

By default, the JWT Authentication is disabled, but can be enabled by configuring the `docker-compose.yml` file. Currently, the supported algorithm is HS256，HS384，HS512，RS256 ，RS384，RS512. This section will take HS256 and RS256 as examples to configure the yml file.

Enable HS256 validation example

Suppose the private key is 123, then in the `docker-compose.yml`, add the following environment variables:

    S8_WEBPDF_SECRET_JWT_ALG=HS256
    S8_WEBPDF_SECRET_JWT_KEY=MTIz

The MTIz is the base64 form of private key 123. In your Authentication server, you will pass the HS256 and MTIz to generate a token, and pass it to the client side - FoxitPDFSDKforWeb.

Enable RS256 validation example

1.Use RS256 to generate a pair of private and public key:

    openssl genrsa -out rs256.key 2048
    openssl rsa -in rs256.key -pubout  -outform PEM -out rs256_pub.pem

An example of the public key - rs256_pub.pem:

    -----BEGIN PUBLIC KEY-----
    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnWZFgIRR9rKrELY6ag37
    2vSv8wy5MFamMFUFgwbnr9xtR1GxVlYoZ+itDlSG8TZvhQSDumraRKxHNDSpwzfE
    bRTqaMk4wqocm5ZqqRH7C80VN7IIzg8XHcD/5BnZ/SaiFfV0RDyiCl7zjwt7Oysk
    l829BxBb3G6U3yCMfld9MY3IpK/CuKlHtwvmhezXKPSnRDiq6vwJ1UwoD6Fy2pEd
    CCdTAaBuuHe/XF1xCVR4ul+uXR4gGParkXfskOHbTgMm82ZimqCWeAOIhqwiL24y
    BOm0lHXv4Ql0cWtOgFQv8mzE2cnTc0txpO2wFxr3C0BloYEX15cm+88h/GfLcLur
    qwIDAQAB
    -----END PUBLIC KEY-----

2. In the `docker-compose.yml`, set the algothrim and public key to the corresponding environment variables:

    S8_WEBPDF_SECRET_JWT_ALG=RS256
    S8_WEBPDF_SECRET_JWT_KEY=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnWZFgIRR9rKrELY6ag372vSv8wy5MFamMFUFgwbnr9xtR1GxVlYoZ+itDlSG8TZvhQSDumraRKxHNDSpwzfEbRTqaMk4wqocm5ZqqRH7C80VN7IIzg8XHcD/5BnZ/SaiFfV0RDyiCl7zjwt7Oyskl829BxBb3G6U3yCMfld9MY3IpK/CuKlHtwvmhezXKPSnRDiq6vwJ1UwoD6Fy2pEdCCdTAaBuuHe/XF1xCVR4ul+uXR4gGParkXfskOHbTgMm82ZimqCWeAOIhqwiL24yBOm0lHXv4Ql0cWtOgFQv8mzE2cnTc0txpO2wFxr3C0BloYEX15cm+88h/GfLcLurqwIDAQAB

In your Authentication, you will pass the algothrim and private key to genenrate a token and then pass it to the `open file` functions to the client side -FoxitPDFSDKforWeb Standalone.

## # Enable JWT authentication on FoxitPDFSDKforWeb Standalone

You can pass the paramenter `jwt` to one of the following open file functions to enable JWT authentication.

- PDFViewer.openPDFByFile
- PDFViewer.openPDFByHttpRangeRequest
- PDFViewer.openPDFById
- PDFViewer.reopenPDFDoc

Example:

    pdfui.openPDFByHttpRangeRequest(request,{
          jwt: getJWT()
          })
    pdfui.openPDFByFile(pdfDoc,{
          jwt: getJWT()
          })
    pdfui.openPDFByID(docID,{
          jwt: getJWT()
          })
    pdfui.reopenPDFDoc(pdfDoc, {
          jwt: getJWT()
          })