JSON Web Tokens

#1

Post by adamnemecek » Mon, Sep 08, 2014, 1:05 AM UTC

Re: JSON Web Tokens

#2

Post by necubi » Mon, Sep 08, 2014, 2:35 AM UTC

JWTs are a pretty great solution for various authentication and authorization related problems, like OAuth tokens, password reset tokens and the like. Using an information-bearing (and signed) token like a JWT tends to make your web apps less stateful and simpler, by offloading the problems of determining authorizations to a single, central location.

The main downside is that the representation (base64-encoded json) is pretty bulky for something that might be used in HTTP headers and URLs, but it does make them easy to debug.

Re: JSON Web Tokens

#3

Post by jpdlla » Mon, Sep 08, 2014, 2:36 AM UTC

Shameless plug, but just gave a JWT talk at DjangoCon this week.

https://speakerdeck.com/jpadilla/djangocon-json-web-tokens

Re: JSON Web Tokens

#4

Post by syncsynchalt » Mon, Sep 08, 2014, 2:45 AM UTC

We've been using them for a zendesk SSO integration, it was pretty painless.

Re: JSON Web Tokens

#5

Post by emeraldd » Mon, Sep 08, 2014, 2:46 AM UTC

How does this not lead to a situation where you are trusting the client for authentication/authorization information?

Re: JSON Web Tokens

#6

Post by finnn » Mon, Sep 08, 2014, 2:46 AM UTC

emeraldd wrote: post #5

How does this not lead to a situation where you are trusting the client for authentication/authorization information?

It looks to me like the data is cryptographically signed

Re: JSON Web Tokens

#7

Post by necubi » Mon, Sep 08, 2014, 2:59 AM UTC

emeraldd wrote: post #5

How does this not lead to a situation where you are trusting the client for authentication/authorization information?

Tokens can be either signed (using JWS [0]) or encrypted (JWE [1]), which means that you're just trusting that your encryption/signing key hasn't been leaked.

[0] https://tools.ietf.org/html/draft-ietf-jose-json-web-signatu...

[1] http://tools.ietf.org/html/draft-ietf-jose-json-web-encrypti...

Re: JSON Web Tokens

#8

Post by jamest » Mon, Sep 08, 2014, 3:00 AM UTC

Kudos to Auth0 for creating this site. The education, awareness and graphical debugger are great. Thank you!

We (Firebase) use JWTs to integrate with an existing app's userbase[1].

[1] https://www.firebase.com/docs/web/guide/simple-login/custom....

Re: JSON Web Tokens

#9

Post by woloski » Mon, Sep 08, 2014, 3:49 AM UTC

Thanks for spreading the word Adam!

We (Auth0) are heavy promoters of the usage of JWT. Here are some articles about using JWT instead of cookies on single page apps with APIs, and its pros/cons.

https://auth0.com/blog/2014/01/07/angularjs-authentication-w...

https://auth0.com/blog/2014/01/27/ten-things-you-should-know...

Re: JSON Web Tokens

#10

Post by segphault » Mon, Sep 08, 2014, 4:15 AM UTC

JWT is a fairly elegant choice in cases where you have a session-less API backend that is consumed by an SPA and/or mobile clients.

I've been really pleased with how simple and straightforward it is for implementors. It's good to see it getting more visibility. Thanks to Auth0 for educating the community.