Live data from Hacker News

Authentication with Django and Single Page Apps (2020)

mikesukmanowsky.com

21–30 of 39 posts

Re: Authentication with Django and Single Page Apps (2020)

#21
post #15

Earlier quoted context omitted.

Claiming that technology A shares the same issues as technology B while technology B is all the hype doesn’t exactly spell out why I should use technology B over technology A. And this is assuming I actually accept your claim that they share the same issues . . .

I think the selling point for JWTs are that they're a mostly-standardized way to do auth tokens such that you only need to do one very simple and cheap database query (is this a token that has been invalidated but hasn't yet expired) rather than a larger number of database round-trips to implement various authorization checks.

But that's true of session auth as well. The only necessary check is "does this session token exist and have a creation date within the expiry period", which should be a single, fairly quick database query for all but the most extreme "at scale" cases. You should not need multiple round trips to validate that.

The main use cases for JWT are:

* I want to create a session token that I _never_ want to revalidate against a database, and still trust that the only way it can exist is if a user has logged in at some point. This means that you're not going to be and to log a user out of your system, but that can be a valid trade-off in some situations (e.g. low-security applications where the cost of storage is very high, or microservice architectures where the token can be validated on ingress but doesn't need to be revalidated later).

* I want to include role (or other) information directly in the token for the sake of convenience, so I never need to pull information from other sources (in which case there are definitely other ways to do this, but just using a JWT library and using the result as a session token might be easier than the alternatives).

But most cases of using JWT tokens that I've seen has basically involved using them as overly complicated session tokens with all the same problems, and none of the benefits that JWT itself can bring. In that case, you may as well just take the easier option in the first place.

Re: Authentication with Django and Single Page Apps (2020)

#23

Earlier quoted context omitted.

I think the original motivation was tied to when people were trying to build unified APIs for every kind of client: web, mobile, m2m. Cookies and sessions werent always available afaik.

I was under the impression sessions were just arbitrary tokens backed by some server-side logic (or perhaps a database) At its core isn't it possible to just take an object, encrypt it with a secret, store it client-side somewhere (cookies, localstorage, filesystem, printed-on-paper, whatever), send it back to the server, and it decrypts it? I don't quite see the difference (or benefits) of JWTs over something like t…

Storing state in JWT is easy way to share state, such as user permission, between different server.

But state in JWT can be outdated due to permission changes and you it's not possible to just expire it as it's stored in client.

To solve the problem, more complex auth setup is needed such as using short lived JWT, refresh token, which feels more like a bandaid to make JWT sufficiently secure

Re: Authentication with Django and Single Page Apps (2020)

#24
post #21
post #15

Earlier quoted context omitted.

I think the selling point for JWTs are that they're a mostly-standardized way to do auth tokens such that you only need to do one very simple and cheap database query (is this a token that has been invalidated but hasn't yet expired) rather than a larger number of database round-trips to implement various authorization checks.

But that's true of session auth as well. The only necessary check is "does this session token exist and have a creation date within the expiry period", which should be a single, fairly quick database query for all but the most extreme "at scale" cases. You should not need multiple round trips to validate that. The main use cases for JWT are: * I want to create a session token that I _never_ want to revalidate against…

> I want to create a session token that I _never_ want to revalidate against a database

There's the middle ground as well with a long lived authentication or refresh token and a short lived authorization token.

> I want to include role (or other) information directly in the token for the sake of convenience

Once I started seriously developing cloud solutions, this became indispensable. It's not just convenient, it directly reduces expenses.

Re: Authentication with Django and Single Page Apps (2020)

#25

Earlier quoted context omitted.

Huh? Sessions and TOTP aren’t mutually exclusive. In fact, they work quite well together. And since when were cookies and sessions 1998-level technology? That’s ridiculous.

Should they have said 1994-level? :P

I don't recall setting HttpOnly cookies in 1994...

Re: Authentication with Django and Single Page Apps (2020)

#26
I'd also written an article on token authentication for django: https://www.spapas.net/2021/08/25/django-token-rest-auth/ using the REST Framework's TokenAuthentication.

This is simplest thing for most cases.

The session authentication that is proposed in the article is also great but has two problems:

* It will be hacky to implement for mobile apps (it should be possible but would not be something I'd like to do, I had tried in the past and remember that I needed to jump to a lot of hoops to "pick" that session cookie)

* The cookies can't be shared between different domains (cookies be shared the same domain or between a parent and child domain, i.e api.example.com can set/get cookies from .example.com).

So you can use the SessionAuthnentication if your frontend and backend share their domain and you know that your API won't ever be used for mobiles apps. On all other cases use TokenAuthentication.

I don't have experience with JWT Authentication, however I know it can be done and is used be various apps f.e baserow: https://gitlab.com/bramw/baserow/-/blob/develop/backend/src/...

Re: Authentication with Django and Single Page Apps (2020)

#27
This works for quite a few simple and not so simple usecases. You should look into using proper oauth2 or oidc when it makes sense to do so.

For example if you want multiple services or sites to use the same login/token. There is keycloak and django-oidc-provider. Those handle users and tokens for you.

Re: Authentication with Django and Single Page Apps (2020)

#28
post #14

I pretty much agree with the sentiment of this post. I’ll probably get downvoted for saying this . . . Ever since using JWT’s became a trend, I’ve found that I can’t get a useful answer almost every single time I’ve asked an engineer (or team) why they picked JWT’s over old, boring, and tested sessions for a web app. It seems, just like React, GraphQL, etc., a lot of the industry just love jumping on bandwagons. I se…

Is this really about buzzwords or a lack of understanding of the technology choices? Django Sessions is equivalent to stateful JWT authentication. Your choice of using one over the other depends on your constraints. But if I needed a session's based solution, I'd probably go with a stateful JWT implementation rather than Django own session. That is unless I am building a really basic app, and looking to get done with…

There is no reason to use JWT in this case. Because you trust your session store, right? The only benefit of JWT is when you can't trust the "hands" the token passed through. Otherwise just use JSON...

Not sure what "stateful JWT authentication" is supposed to be anyway...

Re: Authentication with Django and Single Page Apps (2020)

#29

I personally feel so validated after reading this post. The past 3 weeks have been me personally, painfully re-deriving this information independently. JS FE culture is so fucking obsessed with “modern” instead of what works best. I am using a very similar stack to the author, but I couldn’t find anything as useful as this post. I feel like an insane person sifting for information for React. So much SEO spam clogging…

Yeah. Session authentication works just fine. Especially on the same domain with only one service.

As soon as you need multiple services it gets trickier.

I found those libraries that provide React components for authentication less useful. I prefer to store authentication state in a redux store and manipulate it with a vanilla client library ("ts-oidc-client" or the keycloak specific one).

Re: Authentication with Django and Single Page Apps (2020)

#30

I pretty much agree with the sentiment of this post. I’ll probably get downvoted for saying this . . . Ever since using JWT’s became a trend, I’ve found that I can’t get a useful answer almost every single time I’ve asked an engineer (or team) why they picked JWT’s over old, boring, and tested sessions for a web app. It seems, just like React, GraphQL, etc., a lot of the industry just love jumping on bandwagons. I se…

The use of trusted jwt libraries which outsource registration and authentication has massive benefits such as SSO and reducing the risk of vulnerabilities (user reg/auth being handled by a dedicated party). There’s no reliance on a database or state management, which can be useful under some conditions. In my eyes, the problem is reliance of the authorisation header instead of cookies, this has some benefits but is a…

How is your first paragraph a result of using JWT over sessions?
Post reply on HN