JSON Web Tokens vs. Sessions

If you need to validate the Authorization header on every request that's not really different than using session tokens we've been using for the past 15 years. JWT is just a formalized way of managing cookies. Which is nice and I like it, but it doesn't actually enable anything that couldn't be done before albeit with a more ad hoc approach.

Re: JSON Web Tokens vs. Sessions

#7

Post by harikb » Sat, Jun 18, 2016, 5:00 PM UTC

smaili wrote: post #4

Correct me if I'm wrong but the benefits sound very similar to a good old fashion cookie except that you're not limited by 4kb.

Right, but then the browser is automatically doing the job for you (saving the cookie and then returning in the next request). That would be so bad! We can't do custom code to acheive the same thing...

Re: JSON Web Tokens vs. Sessions

#8

Post by zatkin » Sat, Jun 18, 2016, 5:02 PM UTC

Aren't cookies the safest approach for storing authorization tokens? I recently found out that both Google and Facebook use cookies for authorization, so it seems like the way to go, though I've read that it gives programmer headaches.

Re: JSON Web Tokens vs. Sessions

#9

Post by nstart » Sat, Jun 18, 2016, 5:07 PM UTC

That last part where he talks about logging out being the responsibility of the client is rather key. Basically I can't invalidate the key from the server side. So if a user's account is compromised and they recover it on their mobile app for example, I can't sign the user out of everywhere else too. It's what has given me pause about jwt so far and has held me back from using it. I find the cookie is generally good enough to hold most other information I need about the user.

Re: JSON Web Tokens vs. Sessions

#10

Post by Negative1 » Sat, Jun 18, 2016, 5:11 PM UTC

smaili wrote: post #4

Correct me if I'm wrong but the benefits sound very similar to a good old fashion cookie except that you're not limited by 4kb.

This is the common misconception. Think of a cookie as a storage 'bucket' on a user's device. It can store up to 4KB in bytes of, well, anything (a string). JWT is format. That's it. It is enciphered and has the ability to store JSON, but otherwise, it's just a format or scheme that allows you to organize how you store your session (or whatever) data. As an example, in my usage I actually store my JWT in a user cookie and all it keeps is the expiration, user id and a few other tidbits I don't want to hit a database for but am comfortable exposing in case the token is cracked.