Bearer tokens are just awful
mjg59.dreamwidth.org
Bearer tokens are just awful
1–10 of 148 posts
Re: Bearer tokens are just awful
#2So don't set the token to expire after the "heat death of the universe", make the user reauthenticate after an appropriate time for the service being used.
Re: Bearer tokens are just awful
#3> In theory you could just hand someone a randomly generated blob, but then you'd need to keep track of which blobs you've issued and when they should be expired and who they correspond to
Is this so difficult?
Re: Bearer tokens are just awful
#4Or you can put device/or ip related info baked into the token. That way when the user device or ip changes, you can invalidate the token.
Re: Bearer tokens are just awful
#5> In theory you could just hand someone a randomly generated blob, but then you'd need to keep track of which blobs you've issued and when they should be expired and who they correspond to Is this so difficult?
It isn't until it is. And wherever you store it is a juicy target.
Re: Bearer tokens are just awful
#6Or you can put device/or ip related info baked into the token. That way when the user device or ip changes, you can invalidate the token.
Device info is spoofable, and tying it to IP means the phone experience is just awful.
Re: Bearer tokens are just awful
#7Or you can put device/or ip related info baked into the token. That way when the user device or ip changes, you can invalidate the token.
> Or you can put device/or ip related info baked into the token. That way when the user device or ip changes, you can invalidate the token.
yeah, I always wondered why there isn't a standard field in the JWT containing a fingerprint/hash of the client's machine/browser/etc.
Re: Bearer tokens are just awful
#8> In theory you could just hand someone a randomly generated blob, but then you'd need to keep track of which blobs you've issued and when they should be expired and who they correspond to Is this so difficult?
It isn't until it is. And wherever you store it is a juicy target.
And more secure would be....what?
Re: Bearer tokens are just awful
#9> In theory you could just hand someone a randomly generated blob, but then you'd need to keep track of which blobs you've issued and when they should be expired and who they correspond to Is this so difficult?
It's strictly more complex without much additional benefit. To have zero-trust random blob tracking you'd still need public key infrastructure, and you'd have a system which is overall more complex and has more ways to break (running out of data storage, network partitions to the database, etc.).
A revocation list would be a smaller, easier-to-distribute dataset if you were going to keep data related to specific tokens around.
Re: Bearer tokens are just awful
#10Or you can put device/or ip related info baked into the token. That way when the user device or ip changes, you can invalidate the token.
> Or you can put device/or ip related info baked into the token. That way when the user device or ip changes, you can invalidate the token. yeah, I always wondered why there isn't a standard field in the JWT containing a fingerprint/hash of the client's machine/browser/etc.
Advertisers would love such a thing