Revealing the Inner Structure of AWS Session Tokens

Apparently medium has two seperate “do you want an account” popups now to click out of before you can read. This is a common problem once the development team for a website grows beyond a certain size- the left hand doesn’t know what the right hand is doing. Perhaps we can find the two project leads implementing them, have them fight to the death in some sort of saw trap, and the survivor gets to keep their javascript asking for my email address?

> Following this revelation, we were able to observe that these keys change on an hourly basis...

Is it recommended to rotate keys hourly, or even daily? Or only for something like AWS - I've read/been told monthly is more than adequate for reg. web apps

I'm skeptical of there being any security implications. Signed but not encrypted tokens are effectively plaintext metadata, and token revocation is still an important operation on the service side, preventing zombie token attacks.

Reading metadata can be useful to know when a token is expired without hitting a remote service.

Hmm, is this structure shared by all AWS-service session tokens? e.g. Amazon-Connect tokens etc.

tl;dr it’s a standard protobuf payload after ignoring the first byte.