Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JWT is a scam and your app doesn't need it

dusanmalusev.dev

Post reply on HN
Print view View original

41–50 of 70 posts

Re: JWT is a scam and your app doesn't need it

#41

Post by amarant »

nathanmills wrote: post #38
amarant wrote: post #32

Skill issue. I personally implemented the Minecraft Auth flow with JWT, and it handles ~250k req/s. It has the added benefit that already logged in users are unaffected if the Auth service goes down(Minecraft is a popular target for script kiddies and ddos attacks, so shit happens). The entire argument the article does about invalidation confirms this: the bit about 5 year tokens. You do automatic token refreshes, wh…

Can you explain how 30 minutes of unauthorized access is safe enough for most use cases? I feel like you glossed over that.

It's not 30 minutes of unauthorised access, it's 30 a minute window where you have some extra attack surface. It's safe enough because exploiting that small attack surface within the timelimit is sufficiently hard that it can be considered safe.

Of course the only completely hack-proof device is a brick.

Re: JWT is a scam and your app doesn't need it

#42

Post by Tiberium »

CodeLieutenant wrote: post #36
Tiberium wrote: post #13

Why post this AI-generated article? Just to ragebait?

It's not, it's just something that I've had problem with a long time. Not everything is AI generated, and I hate if someone writes AI articles especially something important like this. These are my general thoughts about it, everything here that I explained is the things I've seen in the wild, and what people are doing. I'm just fed up with it One thing that I did AI generate is the website itself. I really didn't ha…

[flagged]

Re: JWT is a scam and your app doesn't need it

#43

Post by minraws »

nathanmills wrote: post #38
amarant wrote: post #32

Skill issue. I personally implemented the Minecraft Auth flow with JWT, and it handles ~250k req/s. It has the added benefit that already logged in users are unaffected if the Auth service goes down(Minecraft is a popular target for script kiddies and ddos attacks, so shit happens). The entire argument the article does about invalidation confirms this: the bit about 5 year tokens. You do automatic token refreshes, wh…

Can you explain how 30 minutes of unauthorized access is safe enough for most use cases? I feel like you glossed over that.

I think the perspective is most systems don't need validation based security, only access based security.

So it's fine for some services to serve requests after the access has been revoked for a few extra minutes or seconds.

For some it isn't. I have no say on the matter, I feel like security lax-ness makes sense for games, since jacking sessions with jwt is significantly less consequential and you have other sources to validate session health, such as route and ip address.

You can always revoke jwt if the ip address for which it was issue has changed or the route is different and so on and can be even more secure against forgery attacks.

Still not perfect and I find OP's take the it's good enough for banking to be sus.

But it's definitely not a scam, it's simple easy and trivial to use for a lot of low risk services.

You should build a map of low risk and high risk access and not use jwt for anything high risk, because jwts definitely provider better user experience for relatively less effort and resources and technical complexity needed.

Re: JWT is a scam and your app doesn't need it

#44

Post by sliqqq »

cyberge99 wrote: post #9

Who’s still on x86 in 2026?

Friendly reminder: Some nuclear silo facilities in the US still use 3,5" diskettes. Some highly complex system are by architecture, security issues or by incompetence still stuck in decades old tech. We as engineers oftentimes have to work with that, and keep the system running, if we like it or not.

You cannot refactor an battlecarrier designed in 1979 so easily ;)

Re: JWT is a scam and your app doesn't need it

#45

Post by dullcrisp »

CodeLieutenant wrote: post #19
fontain wrote: post #14

How often do we need to revoke individual JWTs anyway? You solve for cookie theft with short expiry and key compromise by rotating keys. I don’t find the revocation issue very compelling as a reason to ditch JWTs.

You have never used "Log me out from everywhere" feature. I've used it. Also it's for I want to change my password and invalidate all sessions.

Is revocation really such a hard problem? Seems you could store a set of revoked tokens in memory and have a background task update it every couple of seconds. I guess it’s a separate set of infrastructure to maintain but I don’t see why it’s always presented as the thing that undermines an entire authentication scheme.

I guess if you need your tokens revoked this millisecond it’ll require an extra synchronous call on every request but that seems like a unlikely requirement. And not that any of this matter for your 10 user app anyway I guess.

Re: JWT is a scam and your app doesn't need it

#46

Post by fontain »

CodeLieutenant wrote: post #19
fontain wrote: post #14

How often do we need to revoke individual JWTs anyway? You solve for cookie theft with short expiry and key compromise by rotating keys. I don’t find the revocation issue very compelling as a reason to ditch JWTs.

You have never used "Log me out from everywhere" feature. I've used it. Also it's for I want to change my password and invalidate all sessions.

I don’t recall ever in my life using that feature on the small number of services that offer it.

Re: JWT is a scam and your app doesn't need it

#47

Post by Tiberium »

This article is completely AI-generated, anyone who reads LLM output often can confirm that. And Pangram confirms it as well. It's one of the more reliable LLM detectors and has an extremely low false positive rate, although in this case it marked Markdown parts too (they're irrelevant since it's a web article, not a normal post).

https://www.pangram.com/history/c68104cd-6072-4f7a-850b-e534...

Re: JWT is a scam and your app doesn't need it

#48

Post by nathanmills »

amarant wrote: post #39
nathanmills wrote: post #16

Earlier quoted context omitted.

Let's say a friend sends you an exe file, a game they made. You run it, and immediately realize it wasn't actually your friend. The attacker has stolen your JWT session cookie. The attacker hasn't done anything yet - they are configuring their browser cookies to match yours. You go to invalidate your session / change your password, but it doesn't help. The attacker has a full hour to do whatever they want on your acc…

Add a client IP field to the JWT. Token is only valid if the request comes from the associated IP. Done.

Geez, I need to re-sign in every time my mobile data switches IP?? IPs are NOT static. Mobile networks change IPs CONSTANTLY. What if I use a VPN (I do) and my IP changes constantly? What if an IOT device on your network is serving as a public residential proxy that anyone can use (more common than you may think), or hell, you have CGNAT and your neighbor does? What if an entire country only goes through one IP[1]? Have you done this in practice?

[1] https://en.wikipedia.org/wiki/User:82.148.97.69

Re: JWT is a scam and your app doesn't need it

#49

Post by nathanmills »

grassfedgeek wrote: post #40
jeroenhd wrote: post #31

Earlier quoted context omitted.

The pattern described is a common Discord account theft method and it has proven very effective at locking people out of their accounts.

The example requires immediate action. If the hacker beats you he can lock you out by taking over the account, it doesn't matter if it is JWT or some other tech.

Why would it require immediate action? Most chat services have a rate limit, stopping them at ANY point prevents it from spreading further. The messages don't get all sent at once, they will use the full access period to send as much as they can. Accounts can't typically be taken over with just a cookie, changing passwords normally requires you to confirm your current one. I hope you haven't designed any services where a cookie is enough to lock people out.

Re: JWT is a scam and your app doesn't need it

#50

Post by amarant »

nathanmills wrote: post #48
amarant wrote: post #39

Earlier quoted context omitted.

Add a client IP field to the JWT. Token is only valid if the request comes from the associated IP. Done.

Geez, I need to re-sign in every time my mobile data switches IP?? IPs are NOT static. Mobile networks change IPs CONSTANTLY. What if I use a VPN (I do) and my IP changes constantly? What if an IOT device on your network is serving as a public residential proxy that anyone can use (more common than you may think), or hell, you have CGNAT and your neighbor does? What if an entire country only goes through one IP[1]? H…

The IP field in particular: no. It was a top of my head solution to a situation that's pretty much fucked. The scenario where an attacker gets control of a client machine is very hard to defend against, regardless of Auth scheme.

But hey, since jwt is so insecure, why don't you go ahead and hack my Minecraft account? I implemented the JWT -based Auth they use, and my username is iworkatmojang.

Get back to me when you've changed my password

Post reply on HN