# @auth - JWT in JWE format - can dgraph handle it?

**URL:** <https://discuss.dgraph.io/t/auth-jwt-in-jwe-format-can-dgraph-handle-it/10148>\
**Category:** Dgraph\
**Tags:** kind:question, auth, dgraph, area:security, ticket:created\
**Created:** [September 9, 2020, 4:07pm UTC](https://discuss.dgraph.io/t/auth-jwt-in-jwe-format-can-dgraph-handle-it/10148 "2020-09-09T16:07:18Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![gotjoshua](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/gotjoshua/32/4150_2.png) [@gotjoshua](https://discuss.dgraph.io/u/gotjoshua)\
**Post date:** [September 10, 2020, 1:23pm UTC](https://discuss.dgraph.io/t/auth-jwt-in-jwe-format-can-dgraph-handle-it/10148/6 "2020-09-10T13:23:30Z")

</div>

After more thinking, I am considering a strategy like this:

My backed component:

1. gets a valid Oauth token for a user
2. creates a JWE that includes claims:

```auto
{ 
ip: x.x.x.x,
userID: ###,
sessionID: ###
} // this payload would be signed and encrypted with a key 
// that only dgraph and the backend know

```

1. the backend needs to update the user-\>sessionID edge with a facet for the (ip=x.x.x.x)

2. this JWE can be stored by the client and used to authenticate queries and mutations  
via dgraph-js-http and the @auth rules need to do the sessionID and ip matching

In order for all this to work, Dgraph @auth would need to be able to handle decrypting the JWE payload

---

_[View the full topic](https://discuss.dgraph.io/t/auth-jwt-in-jwe-format-can-dgraph-handle-it/10148)._