JWT is a scam and your app doesn't need it • Hacker News Board

Re: JWT is a scam and your app doesn't need it

#31

Post by jeroenhd » Sat, May 23, 2026, 6:39 PM UTC

grassfedgeek wrote: post #25

nathanmills wrote: post #16

Earlier quoted context omitted.

Let's say a friend sends you an exe file, a game they made. You run it, and immediately realize it wasn't actually your friend. The attacker has stolen your JWT session cookie. The attacker hasn't done anything yet - they are configuring their browser cookies to match yours. You go to invalidate your session / change your password, but it doesn't help. The attacker has a full hour to do whatever they want on your acc…

> and immediately realize That's a narrow scenario isn't it, if you have to "immediately" realize?

The pattern described is a common Discord account theft method and it has proven very effective at locking people out of their accounts.

Re: JWT is a scam and your app doesn't need it

#32

Post by amarant » Sat, May 23, 2026, 6:39 PM UTC

Skill issue. I personally implemented the Minecraft Auth flow with JWT, and it handles ~250k req/s. It has the added benefit that already logged in users are unaffected if the Auth service goes down(Minecraft is a popular target for script kiddies and ddos attacks, so shit happens).

The entire argument the article does about invalidation confirms this: the bit about 5 year tokens. You do automatic token refreshes, which requires 5 extra lines of code on the client, and one network request every 30 minutes or so. Log out? Remove the token from the client, and let it expire in the next It's fine to default to jwt, but yeah obviously you can screw it up if you implement it bad enough, and there are certain use cases where token expiry might not be safe enough (banking for example. But honestly with a short enough TTL it might be fine even there. You can totally do 5 minute tokens with automatic refresh gated behind user activity, if you need tighter security)

In the per-request cost table the author complains that signature validation is expensive, yet it's ~half the cost of a redis lookup according to the same table!

To me the entire article sounds like arguing that running shoes are bad because the author got a belly ache after eating one.

Re: JWT is a scam and your app doesn't need it

#33

Post by CodeLieutenant » Sat, May 23, 2026, 6:40 PM UTC

cyberge99 wrote: post #9

Who’s still on x86 in 2026?

Who is not, X86_64 is an extension to X86. Same thing, no need to nitpick

Re: JWT is a scam and your app doesn't need it

#34

Post by antonvs » Sat, May 23, 2026, 6:40 PM UTC

CodeLieutenant wrote: post #12

runnr_az wrote: post #2

Eh. JWTs are super handy if you have a single web experience spread across multiple backend apps on the same domain, with a single SSO server to set up the user auth. Definitely not for storing anything sensitive, but treating it like a fancy session cookie with the minimal amount one needs to securely access resources - customerId or whatever - makes life a lot easier than trying to wire up cookie / session manageme…

How that is possible, when every web framework has a package for handling sessions, and in a secure manner. Rolling everything on your own is time consuming and error prone. I know you should not use library for everything, but this is solved problem for a long long time (like crypto), and just using of the shelf solution is right choice to me. You can set the session to be across multiple subdomains and it will work…

What are you talking about? Good frameworks have support for using guards on endpoints. Typically you add an annotation to the handler and that's it - and your system is then going to be much more secure than most alternative approaches, because the simple one-line guard ensures that only users who are authorized to access a specific resource can access it.

You just haven't understood what JWTs are good for. See my other comment in this thread.

Re: JWT is a scam and your app doesn't need it

#35

Post by antonvs » Sat, May 23, 2026, 6:41 PM UTC

nathanmills wrote: post #3

> I am tired of pretending JWT is fine. I don't get it. Why were you lying to people??? Why were you pretending? Thats not healthy and pretty anti-social.

That's how cargo-culting works.

Re: JWT is a scam and your app doesn't need it

#36

Post by CodeLieutenant » Sat, May 23, 2026, 6:41 PM UTC

Tiberium wrote: post #13

Why post this AI-generated article? Just to ragebait?

It's not, it's just something that I've had problem with a long time. Not everything is AI generated, and I hate if someone writes AI articles especially something important like this. These are my general thoughts about it, everything here that I explained is the things I've seen in the wild, and what people are doing. I'm just fed up with it

One thing that I did AI generate is the website itself. I really didn't have the time to do it on my own and I vibe coded it

Re: JWT is a scam and your app doesn't need it

#37

Post by nathanmills » Sat, May 23, 2026, 6:42 PM UTC

grassfedgeek wrote: post #25

nathanmills wrote: post #16

Earlier quoted context omitted.

Let's say a friend sends you an exe file, a game they made. You run it, and immediately realize it wasn't actually your friend. The attacker has stolen your JWT session cookie. The attacker hasn't done anything yet - they are configuring their browser cookies to match yours. You go to invalidate your session / change your password, but it doesn't help. The attacker has a full hour to do whatever they want on your acc…

> and immediately realize That's a narrow scenario isn't it, if you have to "immediately" realize?

No, it's called an example. I refuse to provide an example for every possible scenario, as that would not fit in the Hacker News comment limit.

Re: JWT is a scam and your app doesn't need it

#38

Post by nathanmills » Sat, May 23, 2026, 6:44 PM UTC

amarant wrote: post #32

Skill issue. I personally implemented the Minecraft Auth flow with JWT, and it handles ~250k req/s. It has the added benefit that already logged in users are unaffected if the Auth service goes down(Minecraft is a popular target for script kiddies and ddos attacks, so shit happens). The entire argument the article does about invalidation confirms this: the bit about 5 year tokens. You do automatic token refreshes, wh…

Can you explain how 30 minutes of unauthorized access is safe enough for most use cases? I feel like you glossed over that.

Re: JWT is a scam and your app doesn't need it

#39

Post by amarant » Sat, May 23, 2026, 6:45 PM UTC

nathanmills wrote: post #16

grassfedgeek wrote: post #5

JWT can be short-lived, for example 1 hour. Then on each request if the token is nearing expiration you decide whether to extend it or not, and if so return a replacement JWT with extended expiration. With a short-lived JWT you don't need to invalidate the JWT. > just put the JWT in an httpOnly cookie You can have two cookies, one that is signed and httpOnly, and another that is unsigned and readable by JavaScript. B…

Let's say a friend sends you an exe file, a game they made. You run it, and immediately realize it wasn't actually your friend. The attacker has stolen your JWT session cookie. The attacker hasn't done anything yet - they are configuring their browser cookies to match yours. You go to invalidate your session / change your password, but it doesn't help. The attacker has a full hour to do whatever they want on your acc…

Add a client IP field to the JWT. Token is only valid if the request comes from the associated IP. Done.

Re: JWT is a scam and your app doesn't need it

#40

Post by grassfedgeek » Sat, May 23, 2026, 6:47 PM UTC

jeroenhd wrote: post #31

grassfedgeek wrote: post #25

Earlier quoted context omitted.

> and immediately realize That's a narrow scenario isn't it, if you have to "immediately" realize?

The pattern described is a common Discord account theft method and it has proven very effective at locking people out of their accounts.

The example requires immediate action. If the hacker beats you he can lock you out by taking over the account, it doesn't matter if it is JWT or some other tech.