Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JWT Tokens are NOT safe

redislabs.com

Post reply on HN
Print view View original

101–110 of 115 posts

Re: JWT Tokens are NOT safe

#101

Post by rmykhajliw »

Looks like Redis is trying to promote itself as a session data storage. From my perspective:

1. There's no difference between stealing jwt or session_id with al the problems it brings

2. Session in external storage is a solution for small projects like personal blog etc. because you have almost no traffic to handle. FOr example: 1kk session with an average size 1k = 1kk * 1k = 1Gb in memory storage. Not so big but you will meet all the issues of 10k connections problems when trying to build a service witch can handle this also it will consume at least 100Mb/s bandwidth just for getting/setting data.

3. Server side session a simple place to store all unnecessary/secure data and also can grow exponentially. I saw plenty projects when in one moment session data was grown over 1Mb. So the limits of JWT is a huge plus

4. JWT is easily scalable solution. It works great with 1k session and with 1kk - 100kk - 1000kk sessions.

5. Migration. Because of limitation of server side session - plenty projects started with DB as session store just because they already have DB. It's way of pain of migration from DB to external storage memcache/redis then to JWT.

From my point I don't see any reason to keep using server session instead of JWT.

Re: JWT Tokens are NOT safe

#102

Post by eldelshell »

rmykhajliw wrote: post #101

Looks like Redis is trying to promote itself as a session data storage. From my perspective: 1. There's no difference between stealing jwt or session_id with al the problems it brings 2. Session in external storage is a solution for small projects like personal blog etc. because you have almost no traffic to handle. FOr example: 1kk session with an average size 1k = 1kk * 1k = 1Gb in memory storage. Not so big but yo…

6. Microservices. It's not unusual to have several Microservices consume a common entity, like say, User. If every microservice has to authorize each request doing a db lookup, it doesn't scale either.

He does bring fair points that it's important to understand before using JWT. If your use case includes immediate logout, or to avoid stale data, then it might better to not use JWT.

Re: JWT Tokens are NOT safe

#103

Post by [deleted] »

haimez wrote: post #13
mbesto wrote: post #6

Earlier quoted context omitted.

Ya, I hate to be pedantic too, but security it almost entirely NOT binary. It should be, but it's not.

I respectfully disagree with both of you. Security should be binary, within a given set of requirements / implementation parameters and the intended threat model. Security must be binary within the space of “are you authenticated or not” (within the massive context specific web of trust and private keys) is binary and if it weren’t that would be a problem.

[deleted]

Re: JWT Tokens are NOT safe

#104

Post by dumpsterdiver »

haimez wrote: post #13
mbesto wrote: post #6

Earlier quoted context omitted.

Ya, I hate to be pedantic too, but security it almost entirely NOT binary. It should be, but it's not.

I respectfully disagree with both of you. Security should be binary, within a given set of requirements / implementation parameters and the intended threat model. Security must be binary within the space of “are you authenticated or not” (within the massive context specific web of trust and private keys) is binary and if it weren’t that would be a problem.

Security is binary, as in zeroes and ones that you will never lay eyes on. You seem to be claiming that security should be easy, when in fact the hacks that come will likely be much closer to the metal than you ever get.

Re: JWT Tokens are NOT safe

#105

Post by nodomain »

In my mind there is always the "red light" recently when I see big tech companies posting "technical blog posts" that are just cloaked marketing stories that pitch their product. The article felt the same and my feeling was confirmed at the end. JWT is unsafe! Use Redis!

So it is good to see that is article already has been flagged here.

Re: JWT Tokens are NOT safe

#106

Post by cphoover »

echelon wrote: post #84
catamphetamine wrote: post #55

Earlier quoted context omitted.

So you don't have to say anything on point. Just abstract imaginary accusations. Move along.

I worked for two years on a session system for an institution that cared deeply about security. We had to trace, kill, kill all for single or multiple sessions, users, or organizations. Do this for entire IP ranges, client versions, or client ids. Rate limit all "session-mutating" (unidirectional state machine) actions, time out, model session confidence, restrict session scopes (subset authz), associate with any ent…

I don't get why you couldn't have a panic bit set the same way you maintain an in memory revocation leak... Also I don't get how this is any different than "what if a DB password" leaks?

What if someone steals a device and copies the httpOnly cookies from the network developer inspector tab then forges the requests using Curl?

I don't see how these problems are unique to JWTs and how they exist unmitigated with the use of in-memory revocation list.

Re: JWT Tokens are NOT safe

#107

Post by cphoover »

jopython wrote: post #93
ppcelery wrote: post #58

maybe you can add a `sid` in jwt token, then store this sid in redis. when you want invoke a session, just del this sid in redis.

The author mentions that "One popular solution is to store a list of “revoked tokens” in a database and check it for every call. And if the token is part of that revoked list, then block the user from taking the next action. But then now you are making that extra call to the DB to check if the token is revoked and so deceives the purpose of JWT altogether." I believe the author is 'assuming' the devs are not using a…

It doesn't have to be a DB tho it could be a server in-memory list that gets updated via pubsub or some other means. This is a hell of a lot faster than doing a network call to a DB and because revocation lists should be small by definition and only exist for the length of the token expiration they are limited in their space requirement

Re: JWT Tokens are NOT safe

#108

Post by cphoover »

ralusek wrote: post #8

TL;DR as always, is that there's nothing wrong with JWT. The problem is with thinking that there is a way to have an authentication token that isn't persisted in any way, so long as you want the ability to invalidate a token (i.e. logout, user banned, password change, etc).

The difference tho is maintaining a list of user ids you dont accept, a "blackist" (likely very small and each record expires as the token expires). This can be kept in-memory

Vs doing a network request to your DB and searching a table that could have millions of rows.

Re: JWT Tokens are NOT safe

#110

Post by tasuki »

> Imagine you logged out from Twitter after tweeting.

I don't use Twitter, but that doesn't sound like the usual use case. If the device you're using is trusted, why log out? If it isn't trusted, why enter your credentials at all?

Post reply on HN