Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What do you use for authentication and authorization?

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 247 posts

Re: Ask HN: What do you use for authentication and authorization?

#141

Post by gavinpc »

throwawaymath wrote: post #24
kc10 wrote: post #20

Earlier quoted context omitted.

It's a common practice to add expiry timestamp for such tokens so each token will expire after certain interval.

That's dandy, but it's a solution which is neither standardized nor native to JWT. It's also a weak, passive form of revocation instead of a robust, active form. How do do you revoke a token prior to timestamp expiry? In 2018 it is fully possible to use authentication libraries which natively support granular control for things like revocation using strong, turnkey cryptography. I would argue most people who think th…

> In 2018 it is fully possible to use authentication libraries

So — getting back to the OP — which libraries?

Re: Ask HN: What do you use for authentication and authorization?

#142

Post by [deleted] »

jondubois wrote: post #66
mcbits wrote: post #18

Earlier quoted context omitted.

JWT is fine if "revoke" isn't in your vocabulary for the service. If you do need to revoke tokens, JWT becomes a racey contraption that requires synchronizing and looking up state on every request, the avoidance of which was the main reason to use JWT in the first place.

If you use a realtime transport like WebSockets, you could keep automatically re-issuing a fresh JWT with a very short (e.g. one minute) expiry every 50 seconds; just push them at an interval to authenticated clients. That way your banning mechanism would only have a one minute a delay. No need to revoke tokens; just let them expire. In such a system, a user would be logged out after one minute of closing the connect…

[deleted]

Re: Ask HN: What do you use for authentication and authorization?

#143

Post by stetrain »

throwawaymath wrote: post #51
geezerjay wrote: post #45

Earlier quoted context omitted.

Yes, that's patently false. The exp payload field is even specified in JWT's RFC along with the token rejection workflow. https://tools.ietf.org/html/rfc7519 The same document also specifies the jti field which is the JWT's nonce.

Again, expiry is not revocation. This is an uncontroversial fact - if you disagree, please advise me as to how you'd revoke a token prior to its timestamp-mandated expiration without augmenting it further. And the jti field is not intended for what you think it is. Anti-replay is not at all the same as revocation. Those are different things entirely. I certainly believe (and have seen) the jti field used in the manne…

You replied to this:

"It's a common practice to add expiry timestamp for such tokens so each token will expire after certain interval."

With this:

"That's dandy, but it's a solution which is neither standardized nor native to JWT."

People are providing evidence that token expiration is native to JWT to refute that statement, while you are arguing in parallel that "expiry is not revocation" which is related but separate.

Re: Ask HN: What do you use for authentication and authorization?

#144

Post by jbattle »

nzoschke wrote: post #110

Ory Hydra https://github.com/ory/hydra Open source OAuth / OpenID connect server The docs, API and Docker images make it really easy to start developing against. Then the Docker images and database migration tools make it easy to deploy into our production infrastructure. Also evaluating the other Ory tools like Keto, a policy engine. The hackability of these is very attractive over closed services like Auth0.

> The hackability of these is very attractive

Maybe not the best choice of phrasing

Re: Ask HN: What do you use for authentication and authorization?

#145

Post by throwawaymath »

gavinpc wrote: post #141
throwawaymath wrote: post #24

Earlier quoted context omitted.

That's dandy, but it's a solution which is neither standardized nor native to JWT. It's also a weak, passive form of revocation instead of a robust, active form. How do do you revoke a token prior to timestamp expiry? In 2018 it is fully possible to use authentication libraries which natively support granular control for things like revocation using strong, turnkey cryptography. I would argue most people who think th…

> In 2018 it is fully possible to use authentication libraries So — getting back to the OP — which libraries?

NaCL, Fernet or Paseto.

Re: Ask HN: What do you use for authentication and authorization?

#146

Post by tixocloud »

arkadiyt wrote: post #4

Hard to say without more concrete details, but if I had to reply in broad strokes: - For web, user/pass login exchanged for plain session cookies. Should be marked httpOnly/Secure, and bonus points for SameSite and __Host prefix [1] - For web, deploy a preloaded Strict-Transport-Security header [2] - For api clients, use a bearer token. Enforce TLS (either don't listen on port 80, or if someone makes a request over p…

What’s the difference between a Bearer Token and JWT? I thought they were related?

Re: Ask HN: What do you use for authentication and authorization?

#147

Post by pritambaral »

geezerjay wrote: post #47
cbo100 wrote: post #46

Earlier quoted context omitted.

In what way? You simply get a bearer token (non JWT) onto the client and use that from local storage instead of a cookie. Your JavaScript code then makes api calls using the same bearer pathway as other api clients. The token can still expire, be revoked, etc. it just prevents you having to handle cookie auth on your api.

You've just described the JWT workflow.

No, they've described a Bearer Token workflow. JWT is a specific method that also (most times) uses Bearer tokens, but it wasn't the first, nor does it have a monopoly on Bearer tokens.

I remember building a service when I was experimenting with web development that used randomly generated tokens in a custom HTTP header, and that is closer to Bearer Token (the standard) than Bearer Token is to JWT.

Re: Ask HN: What do you use for authentication and authorization?

#148

Post by throwawaymath »

michaelt wrote: post #129
nindalf wrote: post #112

Earlier quoted context omitted.

How does it matter how many tokens are in the blacklist? You're looking them up in a DB where the lookup time in lg(n) anyway. To give you an idea of how little it matters, let's say a small blacklist would be 10k tokens while a list of all tokens would 10M. log(10k) = 13.28. log(10M) = 23.25. It's only marginally more, because the main latency of the DB request is the network round-trip time. The actual issue here i…

How does it matter how many tokens are in the blacklist? If you're authentication something internal to a company, like the link between the website and the order status backend, there may be literally one user with one token. In this case, the list of revoked tokens will take little space, and update very rarely! If you're authenticating users logging into your website and you decide user logouts should be implement…

What you’re describing - a microservice architecture - is actually a legitimate use case for JWT. I would say that’s an example of sound authentication, but it’s not session authentication, which is what’s being talked about here. Microservices authenticating and communicating with one another don’t utilize the concept of sessions in the sense that clients (users) and servers do.

For that reason I don’t know that it’s fair to say the disagreement throughout this thread is due to people talking about different things. Microservice authentication notwithstanding, session management is not optimally handled by JWT.

Re: Ask HN: What do you use for authentication and authorization?

#149

Post by luhn »

tixocloud wrote: post #146
arkadiyt wrote: post #4

Hard to say without more concrete details, but if I had to reply in broad strokes: - For web, user/pass login exchanged for plain session cookies. Should be marked httpOnly/Secure, and bonus points for SameSite and __Host prefix [1] - For web, deploy a preloaded Strict-Transport-Security header [2] - For api clients, use a bearer token. Enforce TLS (either don't listen on port 80, or if someone makes a request over p…

What’s the difference between a Bearer Token and JWT? I thought they were related?

A bearer token is opaque. It could be a JWT, it could be something else, depending on the application.

Re: Ask HN: What do you use for authentication and authorization?

#150

Post by luhn »

atonse wrote: post #82
tinco wrote: post #76

Earlier quoted context omitted.

Some people have performance concerns with CORS is the main reason I believe. The overhead is an extra round trip.

I thought the concern was security. Anyway HTTP2 would hopefully address that (through header compression), and things like zero-RTT TLS and keep-alive further minimize the overhead of an additional request. Plus doesn't CORS only make preflight requests periodically, not for every request?

Preflights are cached, but because CORS is per-URL caching can be of limited value. If your API uses `/info` and `/edit`, a preflight request has to be made for both (assuming a preflight is necessary). If your application has dynamic URLs (e.g. `/widget/1`, `/widget/2`, etc.) the problem is exacerbated even further.
Post reply on HN