Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JWT is Awesome

thehftguy.com

Post reply on HN
Print view View original

151–160 of 170 posts

Re: JWT is Awesome

#151

Post by to11mtm »

tracker1 wrote: post #143
bearjaws wrote: post #138

Earlier quoted context omitted.

Meanwhile on sales call with Microsoft: "Authentication takes a few minutes to replicate throughout our systems so a SLO request should be resolved within a few minutes". Stakeholder: Ok sounds good

+1 on this... it can be up to a 30 minute lag in some orgs... oh, you have access to those systems for a while until things sync up... similar for LDAP/AD sync with Nix/windows.

Which makes sense when I think about how some of the more trigger happy orgs made a point of shutting peoples accounts of as they were being walked into a room...

Re: JWT is Awesome

#152

Post by to11mtm »

dwaite wrote: post #146
blablabla123 wrote: post #89

Earlier quoted context omitted.

JWT is basically a spec for how to sign the session cookie. Correct me if I'm wrong but there are 2 fundamentally different ways to do user session management: a) user has a random key that can be compared to stored key (DB, Redis, ...) b) signed session information, probably stored as cookie. It's possible to add additional information in a JWT. And of course it's complexity that adds additional attack surface, but…

Nit: JWTs are leveraged to cover a wide variety of use cases outside sessions.

My favorite use for JWT was actually on the backend for Frontend-to-service-to-service auth. It was actually a pretty natural way to flow the user context around without getting ugly with our API calling conventions.

Basically, Clients all used NTLM to talk to the main site, but the main site would use JWT to pass the authenticated user info to the other services being called. The signature ensured that you couldn't spoof, short of being an authorized user that could get an impersonate token for calling the APIs.

But the nice thing was it meant we didn't really have to hit the DB at all in any of this, and it was way cheaper to implement than an API gateway.

Re: JWT is Awesome

#153

Post by strbean »

twic wrote: post #43
rvz wrote: post #15

Earlier quoted context omitted.

Fernet [0] was just as close to being a suitable and secure JWT replacement. But the specification wasn't really updated in a while so a simpler and another secure alternative to JWT and Fernet would be Branca [1] tokens that uses the same cryptography as PASETO v2.local [2]. Here's some trivia, the name comes from an italian drink from the 19th century named Fernet-Branca [3]. [0] - https://github.com/fernet/spec/bl…

From the 19th century perhaps, but used in some classic cocktails, and so still found in many bars: https://www.diffordsguide.com/cocktails/recipe/930/hanky-pan...

I've heard Fernet and Coke is the traditional "bartender's cocktail".

Had a sip of my fiancee's once, it tastes like someone mixed every soda from the soda fountain with every herb and spice in their spice rack, and then squeezed a healthy dollop of toothpaste in for good measure.

Re: JWT is Awesome

#154

Post by smt88 »

anonsivalley652 wrote: post #56
Aeolun wrote: post #41

Earlier quoted context omitted.

As soon as AWS supports PASETO we can talk, until that time popularity equals value.

No, I was speaking even more generally. There are thousands of mainframes still running COBOL that process trillions/billions of dollars of transactions per day. There are obscure software packages and programming languages you've never heard of doing many important, niche tasks. So no, popularity will never equal value. There is no wisdom in a mob. The. End.

Popularity has value because other people contribute to maintenance. It’s not the only value, but it’s still a necessary minimum for most library selection in professional work.

Re: JWT is Awesome

#155

Post by gorgonian »

spookthesunset wrote: post #139
jteppinette wrote: post #137

Earlier quoted context omitted.

Stakeholder: “so you are saying that after a user is denied access they can still access the resources?” Dev: “yes, but only for 15 minutes. Also, it makes our system more simple and decreases database calls, increase performance, ...” Stakeholder: “nope”

For parts of the site where you need to boot somebody instantly... just hit up the authentication server on every request to validate the session. For parts of the site where it doesn’t matter so much, wait for the token to expire.... It isn’t all or nothing.

I did exactly this on the last implementation of JWT I did. Common actions wouldn’t hit the database if the token was less than an hour old, but actions like changing email address or password would always check the database.

Re: JWT is Awesome

#156

Post by ubu7737 »

throwaway3157 wrote: post #144
jteppinette wrote: post #137

Earlier quoted context omitted.

Stakeholder: “so you are saying that after a user is denied access they can still access the resources?” Dev: “yes, but only for 15 minutes. Also, it makes our system more simple and decreases database calls, increase performance, ...” Stakeholder: “nope”

I actually have this conversation a lot, and the answer is usually "okay" and rarely "nope". Stakeholders have to weigh many more pros and cons.

This is just a terrible security hole and I really think all stakeholders should reconsider it.

If you give every attacker a 3-15 minute window of opportunity, and you ship tokens to anonymous users, you are playing with fire.

Re: JWT is Awesome

#157

Post by aPoCoMiLogin »

couchand wrote: post #46
aPoCoMiLogin wrote: post #33

Earlier quoted context omitted.

> With multiple tabs open, logging out on one tab needs to be synced with rest of the tabs via some event listeners. that's a problem with every site in general, which doesn't use any kind of event listeners.

Well, yes, but it's not exactly the same. Session-based logout (or JWTs with blacklisting) automatically protect resources that haven't been fetched yet, but leave open the possibility of lingering previously-fetched resources. JWTs without a blacklist even leave open the possibility of fetching additional resources with a supposedly logged-out credential. That seems like a much bigger hole.

For me blacklisting is bad idea in general. It can be achieved without blacklisting downsides by using asymmetric keys per user. Where you could rotate keys after things like logout or password change. Keys might be stored in replicated storage, same as session, and deleted/rotated as needed.

Don't get me wrong, JWT it's not silver bullet nor it was meant to be one in first place. It's not session replacement, but there are places where right implementation makes lot of sense.

Re: JWT is Awesome

#158

Post by Scarblac »

zaiste wrote: post #47
tmikaeld wrote: post #4

Was about to write a rant that it's still not better than cookies & sessions, something that has been standard waay longer than JWT. But this video says all I have to say (2018): https://www.youtube.com/watch?v=JdGOb7AxUo0 1 sec takeaway (More in the video): https://i.imgur.com/vUYTYfS.png That said, JWT's are great for stuff like 2-Factor via email link or redirecting from one domain to another. Single use, which it…

I've written such a rant almost a year ago. [1] The article shows how to build a « RESTful » API secured with sessions implemented using regular cookies: simpler & without unnecessary complexity. [1]: https://zaiste.net/creating-secure-rest-api-nodejs-without-j...

That's nice, and how it was done for decades. But I'm looking at JWT in a context where we have an application with a REST API, third parties paying us for licenses want to write frontends running on their own domains using to that API, and authentication servers are run by end user organizations that manage their own users.

Our API knows that that organization's auth server is allowed to sign tokens, the third party frontends can obtain those tokens and send them to our API, and it works (or so I hope, I'm in the reading up on all this stuff phase). Sessions using regular cookies just don't.

Re: JWT is Awesome

#159

Post by Scarblac »

Spivak wrote: post #64
idoubtit wrote: post #58

Earlier quoted context omitted.

That's precisely the use case for JWT I recently had to work with, where cookies are irrelevant. The web server gets a token from the API server, then prepares a few JSON messages that the web client will send asynchronously with JS. Since each message content is signed, the web client can't tamper with what is sent to the API. JWT was perfect for this 3-tiers messaging.

I mean is all this complexity really worth "I can send data to an untrusted client so that it can later send it back to me?" compared to just storing that data somewhere like Redis?

He never said "back to me". Back to somewhere. That may or may not know that Redis exists.

Re: JWT is Awesome

#160

Post by Drdrdrq »

mgreenleaf wrote: post #28

Everytime I see a headline with "JWT" in it, I get excited hoping that it is for "JWt" [1], the "Java Webtoolkit", which I love. It happens when I search for it as well, I look for "Jwt ..." and instead of the beloved toolkit, it comes up with all these json web tokens and HMACs. Aaah, well, I'll keep looking for that wonderful day when it really is the toolkit. I guess it goes without saying that, I recommend it hig…

Thank you, looks interesting. GPLv2, if anyone is curious.
Post reply on HN