Svar
What Does "Eavesdropping" Protection Mean?
In the digital world, "eavesdropping" occurs when a malicious third party intercepts the data traveling between your device and our servers. If you are training on a public Wi-Fi network at a train station or café, an unprotected session could expose your login credentials or learning activity to outside observers.
How we prevent it: TLS 1.3 encryption in transit: All communication between your browser or mobile app and the K3 API travels through an encrypted tunnel. Data is unreadable to anyone who intercepts it mid-transit.
HTTPS is enforced on all endpoints: You will always see the padlock icon in your browser's address bar when using K3. Every API call — login, course progress, test submission — is made exclusively over HTTPS. Unencrypted HTTP requests are rejected.
Encryption at rest: Sensitive data stored on our servers is encrypted at the storage layer, so it remains protected even if the physical infrastructure were ever compromised.
How We Protect Your Session with JSON Web Tokens (JWT)
Once you authenticate, K3 does not rely on traditional server-side session cookies. Instead, we use JSON Web Tokens (JWT) — a modern, stateless authentication standard (RFC 7519) — to secure every interaction between your client and our API.
How it works
Login: You submit your credentials over HTTPS. Our server verifies them and, upon success, issues a signed JWT access token and a refresh token.
API requests: Your client includes the JWT in the Authorization: Bearer <token> header on every subsequent API call. No session state is stored on the server.
Server-side verification: For each request, K3 validates the JWT signature using our private key, checks that the token has not expired, and confirms the issuer and audience claims before granting access.
Token refresh: Access tokens are short-lived. When one expires, the client uses the refresh token to obtain a new access token silently — no password re-entry required.
Why JWT is the right choice for K3
Guarding Against Token Theft and Unauthorized Use
Even with JWT, we apply additional layers of protection:
- Short expiry on access tokens: Access tokens expire quickly, so a stolen token has a very narrow window of usefulness.
- Refresh token rotation: Every time a new access token is issued, the previous refresh token is invalidated. If a refresh token is stolen and used, our system detects the reuse and revokes the entire token family.
- Automatic session termination: If a user is inactive for an extended period, the access token expires naturally, and the session ends — no action required from the user.
- HTTPS-only token transmission: Tokens are never sent over unencrypted channels. The Secure flag is enforced on any cookie-based transport layers, and the API rejects requests made over plain HTTP.
- Token revocation on logout: When a user explicitly logs out, their refresh token is immediately invalidated server-side, preventing reuse before expiry.
Why This Matters for Public Sector and Large Organizations
For our clients in the public sector, data integrity is a legal requirement. Whether it's complying with GDPR or ensuring certification results are authentic and untampered, session security is vital.
- Integrity of results: JWT claims bind the session to a specific user identity, ensuring that the person taking the test is the authenticated user on record.
- Prevention of data leaks: Stateless, signed tokens prevent unauthorized API access without requiring a centralized session database that itself becomes a target.
- Audit trail: Each token carries issuer, subject, and timestamp claims, supporting audit logging for procurement and compliance documentation.
- Defense in Depth: JWT-based auth is one layer within a broader security architecture that includes TLS, WAF, rate limiting, and infrastructure-level controls on our AWS environment.
At KlickData, we don't just deliver knowledge — we deliver it safely. If you have further questions about our security protocols or need documentation for a public tender, our technical team is ready to assist.