Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop using JSON Web Tokens for user sessions

ds-security.com

Post reply on HN
Print view View original

141–145 of 145 posts

Re: Stop using JSON Web Tokens for user sessions

#141

Post by seandoe »

Moneysac wrote: post #139
seandoe wrote: post #99

It's articles like these that make things more confusing for folks who are learning about auth/session security. It's obvious the author has developed strong convictions without really understanding the subject. I can't make it past the first sentence: > ...utilize JSON Web tokens (JWTs) for session handling instead of cookies. One has nothing to do with the other. You can use a jwt and cookies. You can use a db sess…

In a single page application you have to access the JWTs with JavaScript. When we use cookies to implement sessions we have attributes like HttpOnly to prevent the cookie from being referenced by JavaScript code. In this case a XSS vulnerability would not be able to simply access the cookie and take over another users session. What I am trying to say here is that JWTs used in single page applications are dangerous be…

> In a single page application you have to access the JWTs with JavaScript.

Who says you _have_ to? You could set a jwt as an httponly cookie and use it to exclusively validate API requests in your backend.

Re: Stop using JSON Web Tokens for user sessions

#142

Post by PrimeMcFly »

RedShift1 wrote: post #23
embik wrote: post #11

It would be helpful if the post not only told you what to _not_ do (especially when it is a frequently done thing) but offered any sort of alternative.

Probably a generalization but in my experience many IT security people don't seem very pragmatic. "No you can't do that" but no alternative. "No don't use that cipher" but can't tell you the correct one. "Don't use equipment that doesn't receive firmware updates anymore and doesn't support newer encryption standards". "Don't allow mDNS" so no more printing from smartphones or presenting stuff from your laptop using M…

> so no more printing from smartphones or presenting stuff from your laptop using Miracast? It gets tiresome really fast.

You can still print from a phone or present from a laptop, just not with solutions relying on insecure services.

It requires some effort is all.

Re: Stop using JSON Web Tokens for user sessions

#143

Post by Aldipower »

Moneysac wrote: post #140
Aldipower wrote: post #54

Just do not store JWTs in LocalStorage or any JavaScript accessible location. Use secured httpOnly cookies. Validate the JWT on server-side _stateless_. No need for a database. This idea is so good and it works! Just follow best security practice. If you don't, it is not the fault of the JWT. Bad blog article.. Yes, things like Keycloak and such follow _bad practice_. Still not the fault of JWT.

In a single page application it is necessary to access the JWT with JavaScript. Thats why it is so common to save it in the code directly or in the local storage. It is dangerous though, since a XSS vulnerability can be used to access the JWT. This would be totally different with a cookie that is stored with HttpOnly.

No, why? It is very often not necessary to make this accessible to JavaScript, except you are working with refresh tokens. But this is mostly not necessary and overused.

Re: Stop using JSON Web Tokens for user sessions

#144

Post by mewpmewp2 »

mort96 wrote: post #94
mewpmewp2 wrote: post #26

Earlier quoted context omitted.

> I would not try to cram JWT-s into cookies they are too big, but maybe these days nobody cares about the extra bytes Why does the length matter compared to when they are sent with cookies or with a special header?

Cookies are sent with every request, including to every image or script file or style sheet etc etc. When sent as a separate header, you only set it to API requests.

You could use the Path prefix to only send to API endpoints where request has to be authenticated?

Or many usually have separate domain/subdomain names for API and static content in the first place.

I think having a separate prefix/subdomain would be generally good practice for defining scope which should be authed as well.

Re: Stop using JSON Web Tokens for user sessions

#145

Post by stillbourne »

I agree, give everyone a session cookie with an encrypted session id, store JWTs in the http context for the session, make the cookie unreadable by js. If you need to read the properties from the token make an endpoint for that. For god's sake stop giving out the JWTs directly to the client.
Post reply on HN