Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JSON Web Tokens

jwt.io

Post reply on HN
Print view View original

21–30 of 76 posts

Re: JSON Web Tokens

#21

Post by alexanderblom »

iLoch wrote: post #15

I think writing your own variation of this at one point is a sort of rite of passage for web developers. I thought I was so clever with my custom PHP framework and sessionless backend. That said, it's done because it works well and makes sense. I'm glad to see we're finally settling on a recommended way of doing this. I've recently incorporated JWTs into my own application. One of the questions I'd like to ask other…

One way of doing it is having an out-of-bands way of refreshing tokens in responses. So if the token is about to expire you can return an updated one on the side-channel.

Re: JSON Web Tokens

#22

Post by akbar501 »

emeraldd wrote: post #5

How does this not lead to a situation where you are trusting the client for authentication/authorization information?

The client must send authentication credentials to the server. For example, a username/password that's provided by a user. There's nothing initially stored on the client that allows it to authenticate without user input.

Of course, you could use a holder of token scheme to authenticate in the case of server to server communication. However, in this case you're making an assumption that both servers can prevent access to the shared secret.

Re: JSON Web Tokens

#23

Post by akbar501 »

finnn wrote: post #6
emeraldd wrote: post #5

How does this not lead to a situation where you are trusting the client for authentication/authorization information?

It looks to me like the data is cryptographically signed

The JWT is signed. You can optionally encrypt the data in the token.

However, the data in the main request is not encrypted, unless you're doing so via another means.

Re: JSON Web Tokens

#27

Post by dteoh »

Kiro wrote: post #19

How do you invalidate tokens?

You can store the expiry time in the token itself. Then it is up to your server to validate that the token is still live. If you need to mass invalidate every token, you change the signing key.

Re: JSON Web Tokens

#28

Post by cetra3 »

IBCNU wrote: post #24
cetra3 wrote: post #13

For an angular js implementation with server examples: https://github.com/sahat/satellizer It's still a very new project, but looks promising.

Alternatively + [IMHO] more robust security-wise (although both great projects): https://github.com/lynndylanhurley/ng-token-auth

Ah, that looks much more mature than Satellizer.

The only qualm I would have is that there's only a Ruby server side example, with Node as the test suite. I would say expanding that to include more example languages would be beneficial.

Re: JSON Web Tokens

#30

Post by pugz »

jordanthoms wrote: post #25

JWTs are used to great effect in Google's Wallet Digital Goods apis to allow you to control which payments are allowed and authenticate postbacks ( https://developers.google.com/wallet/digital/docs/tutorial ). It's a shame that service seems to be more or less dead...

I hope it doesn't die! I'm building a service based on it :)
Post reply on HN