Live data from Hacker News

Stop using JWT for sessions (2016)

cryto.net

141–150 of 255 posts

Re: Stop using JWT for sessions (2016)

#141
Can anybody recommend a tutorial or book on how to do Authentication properly? Say for the usecase SPA + REST API.

If I google quickly I mostly just find tutorials that turn out to be ads for some 3rd party service. Or other beginner tutorials that don't seem very trustworthy.

I feel like I'm missing something, since this should be a very common use case for most (web) apps.

(Bonus if it also covers User Authorization, i.e. different roles that are allowed to do things or not.)

Thanks.

Re: Stop using JWT for sessions (2016)

#142

I'm not 100% sold. I think JWT's are fine in some situations as long as you know the limitations. Regarding session invalidation, I would handle this in two ways. 1. Support a "Log everyone out" function by storing a simple version number in the JWT. If the version constant in your app is different to the number in the JWT, it is invalid. 2. Support a "I need to logout user X function" by storing a blacklist of token…

> 1. Support a "Log everyone out" function by storing a simple version number in the JWT. If the version constant in your app is different to the number in the JWT, it is invalid.

If you've got the iat property, you could just use that. i.e. anything issued before x time is invalid.

Re: Stop using JWT for sessions (2016)

#143

Like many other articles on JWTs, this one mischaracterizes the trade-offs that exist. You can invalidate individual JWTs, you simply store the blacklisted token IDs in a table in your database. Implemented naively, this results in a request flow in which the database is still accessed on every request, defeating one primary purpose for using JWTs. However, there are better ways. Since the blacklist is just a collect…

> Since the blacklist is just a collection of random token IDs, it isn't sensitive. You can store it anywhere, including in memory in your web servers or in a distributed cache. You can wait during blacklist/token invalidation events until the newly blacklisted token has been propagated.

This is very dangerous advice. If you're advocating for the addition of a fast blacklist storage, you really haven't changed your previous pattern complaint, but the dangeous bit of your advice is implying that it's simple to store "anywhere" such as "in memory in your web servers."

That is a bad idea. If your authentication model is depending on an explicit stop-list to invalidate tokens, then you need to take the integrity of that data set very seriously or be at serious risk of credential replay attacks. A loss of integrity in this data store in unacceptable. Even some eventual consistency can be dangerous (but is generally accepted as a risk if the time envelope is acceptable).

It's much better (from a security standpoint) to have very short lived tokens and constantly revalidate. The revalidation cycles CAN be full database cycles since they occur at a reduced rate, and you can then have more sophisticated policies there without too much trouble.

> All of this is around 90 lines of python in my Django site.

I don't doubt it, but trying to scale your advice to a product or to an environment with actual concurrency opens up a lot of complications you're not considering.

JWTs are, by and large, just an inferior spec with too many brittle edges. You need to be really careful to properly implement JWTs in your environment. You're much better off either sticking to rich session tokens or using something like Macaroons.

P.S., not only is the phrase "black" list steeped in a history you may not realize you're invoking, but it's much less precise than the term "stop list". Please do consider this.

Re: Stop using JWT for sessions (2016)

#144
post #14

Earlier quoted context omitted.

Not true. Encode a token and validate it against a constant, which you change in case of a compromise.

What's the point of having a token if you need to check it with a database on every request? Instead of `SELECT isValid from tokens where token=" "`, why not `SELECT user from sessions where session=" "`?

Why are checking against the DB here? Parent said a constant. You'd just check the constant value within the JWT vs the constant on the backend, and update the backend constant to invalidate.

Re: Stop using JWT for sessions (2016)

#145
post #92
post #80

Earlier quoted context omitted.

You do control what clients (think client_id/secret) can use your APIs. Don't you? You figure it out from there.

No. The discussion here is about using JWT for sessions with web clients. If you’re registering a dedicated client id and secret for each web client, they you’re doing something wrong. If you’re doing this and then also using JWT, then you’re doing something really bizarre, and still wrong. Id/secret pairs can make lots of sense for integrating partner services with your API. They make no sense for web clients, where…

Classic hostility on HN. I'm out, I'll go find my tribe.

Re: Stop using JWT for sessions (2016)

#146

> Unless you work on a Reddit-scale application, there's no reason to be using JWT tokens as a session mechanism. And what should I use when I do work on a Reddit-scale application?

Macaroons. JWTs are a total nightmare from a security perspective in an organization trying to provide a microservice environment. There are way too many potential mistakes permissible in JWTs spec. They nearly always come up when you're stretching across a pair of language environments and a few library versions.

Re: Stop using JWT for sessions (2016)

#147

Earlier quoted context omitted.

How you ENCODE data is different from how you TRANSFER data and neither are related to storing state completely on the client vs the server. You can pass JWTs as cookie data, and you can store nothing but a single session ID in the JWT itself. They are completely orthogonal and have nothing to do with the actual argument. It's misleading when the title and the entire article talks about JWTs vs session/cookies.

> That has nothing to do with JWTs. Progress! You're so close to understanding the article. It wasn't ever about JWTs in particular . It was a response to a widespread engineering antipattern of "storing all session state in a cookie then maybe encrypting or HMACing it so you don't have to store anything server-side". JWT was just how developers tended to implement this antipattern. Like, literally, that was the enti…

Yes I understand that it's about client vs server managed state and the balance between. You can see this noted in my very first comment.

But this article is titled and talks about JWTs at great length with pros and cons, which is completely misleading. The fact that many of the comments here are only talking about JWTs vs cookies and skip over what and where the state is managed only further reflects that confusion.

Perhaps a better article should be written and posted.

Re: Stop using JWT for sessions (2016)

#148

"You cannot invalidate individual JWT tokens" This is not exactly true. There are lots of things you can do to expire tokens. For instance, every JWT has a creation date stamp so you could say on the server side all tokens created before Time.Now() no longer accept as valid. Allowing users to expire ALL tokens, etc.

So you need to maintain state whenever tokens get invalidated, and check this state on every token-bearing request. At that point why not just fetch the rest of your session data out of your database?

And if it’s some kind of global cutoff - well, now every revoked session comes with a log off for every user, which is a usability nightmare.

Re: Stop using JWT for sessions (2016)

#149
post #58
post #37

Earlier quoted context omitted.

Except cookies are quite literally perfect for that - set the expiration to 30 minutes from issuance and it will automatically be expired with inactivity. Or bumped on activity.

Cookies are implementation dependent. It's quite possible that a user agent doesn't honour what you instructed it to do regarding the expiration of a cookie. JWT however... your server side can validate its own token in whatever ways it wants (including expiration). You can't get more secure than that.

If you checking the session on the server, you might as well just use a token in a cookie. The point of the JWT complexity is to avoid that.

Re: Stop using JWT for sessions (2016)

#150

This seems to be targeted at web apps. I take it I don't need to remove JWT token support from all of my mobile applications?

The problems with JWTs go well beyond "how do we do session invalidation." However, since mobile apps tend to be SSL encrypted on devices that don't reveal contents to users, you've often got a lot more leeway than the transparent condition web apps suffer.

I know my app didn't have any real security challenges until we had a website with actionable data.

Post reply on HN