11–20 of 23 posts
JWT is not that complex because there are battle tested libraries available for all languages.
Earlier quoted context omitted.
To clarify for JWT invalidation, you don’t have to store the whole token. Instead just store the jti or some other identifying field that can be checked.
Can you please elaborate on this?
To avoid replay attacks, the backend adds the token's nonce to a scratchpad memory when the token is used in order to invalidate the token even if the expiration timestamp isn't reached.
If a JWT implementation is implemented to ignore replay attacks or even token expiration, the jti can still be used to invalidate tokens.
If you control both the backend and the front end, just use a session cookie.
Quick and easy: Look into Firebase.
Powerful/extensible: Django + DRF
If you control both the backend and the front end, just use a session cookie.
The humble session cookie is what I've been using all these years, but now suddenly everyone is saying "JWT". Any advice on the pros and cons of JWT vs session cookies?
An API Gateway is pretty Quick to set up, but the industry is moving away from it as a concept. Keycloak is nice but requires some work.
> An API Gateway is pretty Quick to set up, but the industry is moving away from it as a concept. Can you elaborate on this?
Depends on your requirements... Quick and easy: Look into Firebase. Powerful/extensible: Django + DRF
If you control both the backend and the front end, just use a session cookie.
The humble session cookie is what I've been using all these years, but now suddenly everyone is saying "JWT". Any advice on the pros and cons of JWT vs session cookies?
Rather than rehashing it all myself, I'd suggest reading http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo... and https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-...