Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Using JWTs

gist.github.com

Post reply on HN
Print view View original

171–180 of 335 posts

Re: Stop Using JWTs

#171

Post by wyc »

What about JWT+DPoP? It would address many of the author's concerns.

https://datatracker.ietf.org/doc/html/rfc9449#name-dpop-proo...

    The JWT specification itself is not trusted by security experts. This should preclude all usage of them for anything related to security and authentication.
Very bold claim that seems to ignore all the iteration and hard-won lessons on this from the ecoystem...

Re: Stop Using JWTs

#172

Post by dheera »

solatic wrote: post #3

Necessary qualifier: for browser-based user sessions. Plenty of good uses for JWTs for service-to-service communication. edit: I read some of the linked stuff, e.g. https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba... . Please, if JWTs are such a horrifically insecure standard, go ahead and publish your means for hacking AWS STS's AssumeRoleWithWebIdentity , or don't publish and just exploit it by launchin…

Why is JWT so messy? base64(something) + "." + base64(something else)?

Why not just base64(JSON.stringify(everything)) ?

Re: Stop Using JWTs

#173

Post by userbinator »

What a bunch of BS...

The JWT specification is specifically designed only for very short-live tokens (~5 minute or less). Sessions need to have longer lifespans than that.

Huh? The expiry is as long or short as you want.

The JWT specification itself is not trusted by security experts.

...and we're supposed to trust some random gist? Pure appeal to authority.

Re: Stop Using JWTs

#174

Post by userbinator »

agwa wrote: post #65
robertlagrant wrote: post #61

Earlier quoted context omitted.

> While common JWT libraries have now mostly got their stuff together, this has not always been the case. There were plenty of libraries accepting the "none" algorithm [1] or allowing attackers to forge tokens by using a public key as a shared secret [2]. This is the direct result of the complexity criticized in the linked blog post. I'm a bit surprised at this. These are extremely simple to solve - the first time I…

You would think so, but even an authentication company screwed it up: https://cybercx.co.nz/blog/json-web-token-validation-bypass-...

Clearly trying to be too general. I wrote a tiny JWT validator before that only allows a very small subset of algorithms because I wasn't expecting the JWTs it would handle to have anything else, and obviously not "none".

Re: Stop Using JWTs

#175

Post by tomjakubowski »

ChicagoDave wrote: post #163

OAuth2 has been the web security standard for ten years. I don’t recall any major security announcements about it. The OP is confused.

I'm confused. What does OAuth have to do with JWTs? They seem orthogonal: OAuth2 doesn't specify a format for access tokens, nor does it require statelessness.

Re: Stop Using JWTs

#176

Post by saganus »

tptacek wrote: post #159
saganus wrote: post #112

Earlier quoted context omitted.

I am still waiting for Macaroons to be used widely. I think they are a fantastic invention. It seems they were not of very much use in the past, but with the agentic-everything now, I see this as a great way of delegating permissions to subagents, third-party agents, etc. Working on something along these lines but unfortunately I cannot dedicate as much time as I'd like. Still, if anyone is reading, give Macaroons a…

We have what I believe to be one of the world's largest deployments of Macaroons. They're a mixed bag, though I think they're a lot more interesting in a world where agents do most of the fiddly work. https://fly.io/blog/operationalizing-macaroons/

I am very aware of your work!

It's the only prod usage of Macaroons I know of, I think.

Third-party discharge seems like a great way to have human-in-the-loop gating, among other interesting things.

Would be great reading your thoughts if you ever write about the agentic use case, having all the fly.io experience

Re: Stop Using JWTs

#177

Post by what »

figassis wrote: post #130
RagingCactus wrote: post #117

Earlier quoted context omitted.

> First, we need to add a token_secret column to our users table: > ALTER TABLE users ADD COLUMN token_secret; So it's "stateless" but we have to query the users database on every request? How is that more stateless than SELECT * FROM session WHERE id = cookie? Ignoring that and taking the mechanism as given: Why the obsession with cryptography, in this case HMAC? I don't see any reason why another signature is neede…

You don't actually have to do a db trip to get a user secret and revoke a token. A token comes in, and you can store the secret in the same place you store your application secret. Because you do need to store it, cache it, whatever. The point here is you no longer need to keep a revocation database of every token you issued that is still unexpired. Just rotate the signing secret and every token issued until then wil…

What? So instead of storing a revocation list, you store a per user secret that you need to consult. What is the difference? How is that stateless? How does it avoid a “rb round trip” (where are you storing the user secret)?

Re: Stop Using JWTs

#178

Post by sieabahlpark »

tracker1 wrote: post #9

JWTs are insecure... even when using trusted, rsa/ppk based signing methods? not shared secrets. JWTs are too long lived... Nothing is stopping you from limiting the JWT lifetime and having a refresh model against an authentication authority... I mean, even if you use cookie based sessions, you're storing somewhere... you can have a jwt valid for 5-15min. 15minutes is roughly the cache timing for many authorization s…

[dead]

Re: Stop Using JWTs

#179

Post by jongjong »

kobalsky wrote: post #64

I agree that using cookies is better for web sessions but I absolutely despise those using the boogeyman to shoo people away from stuff they don't like, instead of asking them to use their brains. > they are not secure. They are secure if they fit your risk profile, a blanket statement like this is just disinformation. Don't treat your peers like idiots.

I've never had any issues with JWT. There's a group of incompetent developers who like to point to a tool as a scapegoat to distract away from their own failure to use the tool correctly.

I think the irony is that the people who make these blanket statements may be idiots themselves and that's why they think everyone else is an idiot. They can't imagine that other people don't have problems using those tools. It's a skill issue.

Some people here built embarrassingly parallel distributed systems with consistent hashing load balancers. JWT is easy by comparison.

To me, it sounds like a child putting their shoes on the wrong feet, getting blisters and concluding that nobody should wear shoes.

Re: Stop Using JWTs

#180

Post by what »

littlecranky67 wrote: post #58
matt-p wrote: post #54

Earlier quoted context omitted.

Can even put it in redis too, if you have performance issues from looking for it in memory then you have probably have more users than google.

What if you have two servers, one in japan and one in central europe? Where do the sessions live? With JWTs, you would only need to replicate your revocation list of the last X hours (X being your JWT default lifetime) and probably be in the megabytes for the total list. Easy to replicate that ever 5-10seconds to all your locations.

You probably don’t need to replicate it? The users hitting your Japan server aren’t going to suddenly hit your central eu server?
Post reply on HN