Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Use JSON Web Tokens

github.com

Post reply on HN
Print view View original

121–130 of 135 posts

Re: How to Use JSON Web Tokens

#121

Post by tptacek »

andrewstuart2 wrote: post #118
tptacek wrote: post #106

Earlier quoted context omitted.

If you always have state, what's the point of making tradeoffs to get closer to "statelessness"? I see clearly why some small subset of applications benefits from carefully minimizing shared state among components. It is not at all clear to me why pseudo-statelessness is a good default .

I'm not sure you're actually asking for my opinion, or just making a point, but IMO, the "statelessness" most people describe with respect to web services simply means that a single request already has as much as possible of the information required (outside of current time, securely fetching/validating public keys, etc) to process the request. The point is that it's easier for distributed systems as a whole when cli…

My subtext is that gains from moving state from the server to the client are often swamped by the first serverside database round trip that has to be done to service requests. So, you see ActiveRecord Rails applications using JWT, and it's like: the benefits of "statelessness" are not rationally why this got deployed.

Re: How to Use JSON Web Tokens

#122

Post by tptacek »

andrewstuart2 wrote: post #119
tptacek wrote: post #104

Earlier quoted context omitted.

This is a little like saying "this is a problem you have with ANY identity solution that looks like JWT". Yes, that's true. The reason people complain about JWT is that (a) it's the most popular solution of this shape, and (b) people use it without understanding why they're using it or whether the tradeoffs work for their application. They usually do not. Witness everyone saying that the important feature of JWT is t…

Would you say then that confidentiality is always preferable to availability? I'm not quite sure how you'd achieve any sort of high availability over time without interoperability at some level. Presumably, if it has any place, that interoperability would belong at the lowest level of a protocol stack, with each successive level tuning acceptable parameters for their application.

I don't understand this question. I don't think it's very common in real-world applications to deliberately trade confidentiality for extra availability, though negligently and subtextually making that trade is endemic to our industry.

Re: How to Use JSON Web Tokens

#123

Post by andrewstuart2 »

tptacek wrote: post #122
andrewstuart2 wrote: post #119

Earlier quoted context omitted.

Would you say then that confidentiality is always preferable to availability? I'm not quite sure how you'd achieve any sort of high availability over time without interoperability at some level. Presumably, if it has any place, that interoperability would belong at the lowest level of a protocol stack, with each successive level tuning acceptable parameters for their application.

I don't understand this question. I don't think it's very common in real-world applications to deliberately trade confidentiality for extra availability, though negligently and subtextually making that trade is endemic to our industry.

I just mean availability in the sense of client support across time as protocol versions increase, like TLS version negotiation and how it enables the gradual rather than immediate dropping of server support for clients on older versions of a spec. Or for example, allowing 2048 bit keys for a time to allow migration to stronger keys.

Without negotiation, you'd have to stop serving clients that haven't upgraded at the cutover time.

Re: How to Use JSON Web Tokens

#124

Post by Kalium »

andrewstuart2 wrote: post #116
tptacek wrote: post #110

Earlier quoted context omitted.

I'm not sure how you can "cargo cult" not casually adopting some random piece of technology. The Pacific cargo cults transformed incidental interactions with modernity into religious venerations; aboriginal islanders got free supplies from visiting GIs, believed the experience to have been supernatural, and built wooden airplane replicas as idols in hopes of summoning those benefits anew. The comparison to JWT is pre…

I'm disappointed. From your reputation and from having heard you speak on podcasts, I expected a bit more enlightening and friendly conversation than condescension and subtle insults. Regarding cargo cults around an opinion, consider this scenario: 1. Be a successful public figure in some domain. 2. Share opinion related to said domain. 3. People elevate opinion itself because of relation to successful individual wit…

I believe the point being made is that flexibility is itself a misfeature that enables misuse. While you are absolutely correct that JWTs could be part of a stricter standard less enabling of misuse, they do not themselves constitute such. And for many purposes, other more specialized and suitable standards (such as Macaroons) already exist.

Re: How to Use JSON Web Tokens

#125

Post by [deleted] »

andrewstuart2 wrote: post #123
tptacek wrote: post #122

Earlier quoted context omitted.

I don't understand this question. I don't think it's very common in real-world applications to deliberately trade confidentiality for extra availability, though negligently and subtextually making that trade is endemic to our industry.

I just mean availability in the sense of client support across time as protocol versions increase, like TLS version negotiation and how it enables the gradual rather than immediate dropping of server support for clients on older versions of a spec. Or for example, allowing 2048 bit keys for a time to allow migration to stronger keys. Without negotiation, you'd have to stop serving clients that haven't upgraded at the…

[deleted]

Re: How to Use JSON Web Tokens

#126

Post by KaiserPro »

techslave wrote: post #69
pkulak wrote: post #53

Earlier quoted context omitted.

His or her point was that if you don't sign and/or encrypt, there's no benefit over a standard cookie.

not sure if that was the point or not, but it's wrong. even if you did sign/encrypt, that's not a benefit over a standard cookie. you can easily sign or encrypt a 'standard cookie' as well. the benefit is the portability that comes from a standardized and widely used data structure.

My point was that allowing 'None' was/is a flaw. If you want to shuttle bits of data about in an unsigned/unencrypted/insecure way, that's what raw cookies are for.

Now, as cookies are buckets to dump data, there is of course nothing to stop you encrypting, signing and doing all sorts of things to cookies.

Re: How to Use JSON Web Tokens

#127

Post by sierdolij »

CiPHPerCoder wrote: post #114
kevinburke wrote: post #92

Earlier quoted context omitted.

Well the good news is I've written about this exact subject at length! I have seen JWT implementations at five or six different companies now, tokens have never been used for more than one use case. For each specific use case you'd actually want to use it with there is a better solution that doesn't involve JWT, like secretbox or HMAC-SHA256. https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/

You might be happy to see the PASETO spec, which (for v2) uses XChaCha20-Poly1305 for encryption, Ed25519 for signatures, separates the two logically, and doesn't allow for runtime ciphersuite negotiation. (v1 achieves a similar result with AES-CTR+HMAC-SHA384-EtM and RSASSA-PSS.) https://github.com/paragonie/paseto/tree/master/docs/01-Prot... It's similar to the advice given above, but also caters to that itch that…

PASETO seems to signal quality: libsodium, simple spec, platform-agnostic in the freak'n name. I keep seeing the horrors and defects of JOSE/JWT, but then it keeps getting promoted. Maybe this is only an anecdotal example, but overly-enthusiastic populism in tech, IME, seems to have track-record of being a road to pain and sometimes ruin.

https://paseto.io

XChaCha20-Poly1305 construction in libsodium https://download.libsodium.org/doc/secret-key_cryptography/a...

Re: How to Use JSON Web Tokens

#129

Post by beardedwizard »

fenwick67 wrote: post #105
beardedwizard wrote: post #14

Earlier quoted context omitted.

CSRF is mitigated by using the samesite cookie flag. XSS is mitigated by httponly, except where XSS makes legitimate requests to domains specified by the cookie. This article describes some of the most vulnerable ways to use a JWT in 2019, but please let's stop talking about none algorithms.

samesite doesn't appear to work in Safari, IE or Edge sadly. EDIT: apparently it's a bit more complicated than that: IE11 on windows 7 doesn't support it, and Safari https://caniuse.com/#search=samesite

Considering the alternative is local storage, and I can include traditional csrf tokens, it still feels like a partially supported samesite flag with httponly is a solid defense against xss and csrf and doesn't lead to a road of dangerous tech debt.

Re: How to Use JSON Web Tokens

#130

Post by paulddraper »

Kalium wrote: post #115
paulddraper wrote: post #113

Earlier quoted context omitted.

> Why in this day an age is encryption not a default for the _payload_? Why would it be? Why not encrypt the disk and use SSL? Doing encryption right can be enormously difficult; why not use the transport/storage technologies that are ubiquitous?

You're right. Doing encryption correctly can be incredibly difficult and complex. Enough so that people might miss important subtleties of the technologies at hand. For instance, you may want the encryption of data-in-transit to be removed by the application, rather than by whatever is responsible for TLS termination. You may not want your load balancer to be capable of reading the most sensitive data of your request…

IDK what the details are there, but if you trust your TLS termination point with most data, it seems like you'd trust it with the JWT payload too.
Post reply on HN