Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JWT is Awesome

thehftguy.com

Post reply on HN
Print view View original

41–50 of 170 posts

Re: JWT is Awesome

#41

Post by Aeolun »

anonsivalley652 wrote: post #18
jillesvangurp wrote: post #10

Earlier quoted context omitted.

Judging from the number of stars of the various git repositories for different languages, there are a few people using it but not a whole lot. The most popular implementation seems to be php based. That suggest to me it's still early days for this. E.g. the Java implementation only has 13 stars, which is not a lot. Also it has a native dependency, which is not ideal. E.g. JWT has a pure Java implementation from oauth…

Popularity != value. Get over false signals.

As soon as AWS supports PASETO we can talk, until that time popularity equals value.

Re: JWT is Awesome

#42

Post by cryptica »

CiPHPerCoder wrote: post #2

Counterpoint: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...

That article doesn't contain a single logical argument.

>> JSON Web Tokens are Often Misused

So is everything else. Name one programming concept which isn't often misused.

>> There were two ways to attack a standards-compliant JWS library to achieve trivial token forgery

The keyword here is "were" - Just like how people in Europe "were" dying from the Bubonic plague - It doesn't mean that Europe is unsafe today.

The up-to-date reality is that JWT today has been battle-tested to an extent that few other web standards have. In a way, all the negative attention due to past issues has made it stronger.

>> JSON Web Encryption is a Foot-Gun... this is somewhat like pointing a gun with 5 out of 6 loaded chambers directly at your foot

...And using session IDs inside a cookie is like eating a cookie laced with cyanide.

Re: JWT is Awesome

#43

Post by twic »

rvz wrote: post #15
CiPHPerCoder wrote: post #2

Counterpoint: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...

Fernet [0] was just as close to being a suitable and secure JWT replacement. But the specification wasn't really updated in a while so a simpler and another secure alternative to JWT and Fernet would be Branca [1] tokens that uses the same cryptography as PASETO v2.local [2]. Here's some trivia, the name comes from an italian drink from the 19th century named Fernet-Branca [3]. [0] - https://github.com/fernet/spec/bl…

From the 19th century perhaps, but used in some classic cocktails, and so still found in many bars:

https://www.diffordsguide.com/cocktails/recipe/930/hanky-pan...

Re: JWT is Awesome

#44

Post by owaislone »

JWT is great for some use cases but if you need auth to be very centralized, just use one of the existing auth mechanism instead of bolting it on top of JWT. I don't see what would be the point of using JWT if you need highly centralized auth.

Where JWT shines is when the auth service does not need to know the clients that might want to authenticate using it. A system where it can issue tokens to any other service on behalf of a user and say, "here you go, you can use this for the next N minutes". This is very useful when it's not practical for every service/client to "register" itself with the auth service before hand like oauth.

Re: JWT is Awesome

#45

Post by 0x445442 »

The string 'JSON Web Token' doesn't appear anywhere on the web page. If you're going to use an acronym expand it out the first time you use it.

Re: JWT is Awesome

#46

Post by couchand »

aPoCoMiLogin wrote: post #33
praveenweb wrote: post #19

JWTs have made client side auth integrations look better. But the problem is that common security considerations and implementation details are generally overlooked. 1. Tokens are typically stored in localStorage. (app becomes vulnerable to CSRF & XSS attacks). 2. Tokens can be stolen. Now this is generally controlled by having a very short expiration time. 3. Short expiration times mean persisting refresh tokens to…

> With multiple tabs open, logging out on one tab needs to be synced with rest of the tabs via some event listeners. that's a problem with every site in general, which doesn't use any kind of event listeners.

Well, yes, but it's not exactly the same. Session-based logout (or JWTs with blacklisting) automatically protect resources that haven't been fetched yet, but leave open the possibility of lingering previously-fetched resources. JWTs without a blacklist even leave open the possibility of fetching additional resources with a supposedly logged-out credential. That seems like a much bigger hole.

Re: JWT is Awesome

#47

Post by zaiste »

tmikaeld wrote: post #4

Was about to write a rant that it's still not better than cookies & sessions, something that has been standard waay longer than JWT. But this video says all I have to say (2018): https://www.youtube.com/watch?v=JdGOb7AxUo0 1 sec takeaway (More in the video): https://i.imgur.com/vUYTYfS.png That said, JWT's are great for stuff like 2-Factor via email link or redirecting from one domain to another. Single use, which it…

I've written such a rant almost a year ago. [1] The article shows how to build a « RESTful » API secured with sessions implemented using regular cookies: simpler & without unnecessary complexity.

[1]: https://zaiste.net/creating-secure-rest-api-nodejs-without-j...

Re: JWT is Awesome

#48

Post by CiPHPerCoder »

Aeolun wrote: post #41
anonsivalley652 wrote: post #18

Earlier quoted context omitted.

Popularity != value. Get over false signals.

As soon as AWS supports PASETO we can talk, until that time popularity equals value.

Give me a few months, then. :P

If they agree it's a good idea, it should pick up quickly.

Re: JWT is Awesome

#50

Post by schnable »

tmikaeld wrote: post #4

Was about to write a rant that it's still not better than cookies & sessions, something that has been standard waay longer than JWT. But this video says all I have to say (2018): https://www.youtube.com/watch?v=JdGOb7AxUo0 1 sec takeaway (More in the video): https://i.imgur.com/vUYTYfS.png That said, JWT's are great for stuff like 2-Factor via email link or redirecting from one domain to another. Single use, which it…

JWT has many uses that have nothing to do with web browsers. The author doesn't mention anything about web browsers in the post. This line of JWT criticism needs to go away unless JWTs are being discussed specifically in a browser-based scenario.
Post reply on HN