Stop using JWT for sessions (2016)
cryto.net
Stop using JWT for sessions (2016)
1–10 of 255 posts
Re: Stop using JWT for sessions (2016)
#2Obviously written by a non-expert. Half of the claims here are false and he only references other blogs. OWASP is nowhere to be found.
Re: Stop using JWT for sessions (2016)
#3This JSON Web Token Security Cheat Sheet[1] or this python script[2] are both quite useful when reviewing anything using of JWTs.
[1] https://assets.pentesterlab.com/jwt_security_cheatsheet/jwt_...
Re: Stop using JWT for sessions (2016)
#4Obviously written by a non-expert. Half of the claims here are false and he only references other blogs. OWASP is nowhere to be found.
I’m hoping this is sarcasm.
Re: Stop using JWT for sessions (2016)
#5Obviously written by a non-expert. Half of the claims here are false and he only references other blogs. OWASP is nowhere to be found.
This comment is completely unhelpful without detailing which half.
Re: Stop using JWT for sessions (2016)
#6what about setting a secure cookie with a jwt, and expiring it when you log-out?
what is the utility in server-sessions?
(aside from the ability to revoke it at any time from the server.)
Re: Stop using JWT for sessions (2016)
#7We have a requirement that users be logged out after 30 minutes of inactivity, so JWTs are perfect for our use case.
Re: Stop using JWT for sessions (2016)
#8Re: Stop using JWT for sessions (2016)
#9We have a requirement that users be logged out after 30 minutes of inactivity, so JWTs are perfect for our use case.
What about a stolen user password and an actor, who already uses your token? Can the targeted user kick him out by resetting his / her password?
Re: Stop using JWT for sessions (2016)
#10Burp Plugin for JWT decoding / attacks
https://github.com/mvetsch/JWT4B