Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JWT is a scam and your app doesn't need it

dusanmalusev.dev

Post reply on HN
Print view View original

61–70 of 70 posts

Re: JWT is a scam and your app doesn't need it

#61

Post by milch »

Tiberium wrote: post #47

This article is completely AI-generated, anyone who reads LLM output often can confirm that. And Pangram confirms it as well. It's one of the more reliable LLM detectors and has an extremely low false positive rate, although in this case it marked Markdown parts too (they're irrelevant since it's a web article, not a normal post). https://www.pangram.com/history/c68104cd-6072-4f7a-850b-e534...

To be fair here if you look at their "supporting evidence" most of it is pointing at markdown formatting. Some of the other things it points to are also just common in human writing, though the overuse leans more towards coming from an LLM, e.g. two instances of groups of three back to back with inconsistent use of the Oxford comma:

> If you're building a web app, a mobile app, or a first-party API: JWT is the wrong default and you should stop reaching for it. A row in Postgres with a bearer token in front of it is faster, simpler and strictly more secure.

Re: JWT is a scam and your app doesn't need it

#62

Post by Tiberium »

milch wrote: post #61
Tiberium wrote: post #47

This article is completely AI-generated, anyone who reads LLM output often can confirm that. And Pangram confirms it as well. It's one of the more reliable LLM detectors and has an extremely low false positive rate, although in this case it marked Markdown parts too (they're irrelevant since it's a web article, not a normal post). https://www.pangram.com/history/c68104cd-6072-4f7a-850b-e534...

To be fair here if you look at their "supporting evidence" most of it is pointing at markdown formatting. Some of the other things it points to are also just common in human writing, though the overuse leans more towards coming from an LLM, e.g. two instances of groups of three back to back with inconsistent use of the Oxford comma: > If you're building a web app, a mobile app, or a first-party API: JWT is the wrong…

Supporting evidence isn't what makes Pangram mark something as AI-generated, though. And I did call out that in my post specifically. But the post is still 100% generated, it has a distinct Claude-adjacent LLM style.

Some of the extremely obvious examples:

> The pitch is: the server signs it, the client carries it, every subsequent request only needs a signature verification — no database round-trip.

> You can't. That's the answer. The token is valid until it expires, full stop.

> A single opaque token, looked up in Redis with Postgres as the backing store, gives you the same security in one line of middleware. No refresh. No second token. No retry loop. Nothing.

> With opaque tokens this is just… how it works. No mismatch, no hidden tax, no "did they implement the checks correctly" question to lose sleep over.

Re: JWT is a scam and your app doesn't need it

#63

Post by cluckindan »

alex_smart wrote: post #24

Who uses JWT like this anyway? Typical production architecture would look like - frontend only ever sees an opaque session cookie - bff stores the access token against session and attaches it when calling backend services Yes, storing JWTs directly in the frontend client is a bad idea but surely there is a better way of communicating that than "JWT is a scam and your app doesn't need it". > RS256 verification is in t…

Almost every OAuth2 service out there does exactly that: access token for client/bff, refresh token in HttpOnly cookie.

It’s a lot of work to get it right in SSR environments, since both the bff and the frontend need to be able to refresh the access token (preferably transparently during an in-flight request). Even then, access tokens really should expire within a minute or two, not hours or days.

Re: JWT is a scam and your app doesn't need it

#64

Post by milch »

minraws wrote: post #43
nathanmills wrote: post #38

Earlier quoted context omitted.

Can you explain how 30 minutes of unauthorized access is safe enough for most use cases? I feel like you glossed over that.

I think the perspective is most systems don't need validation based security, only access based security. So it's fine for some services to serve requests after the access has been revoked for a few extra minutes or seconds. For some it isn't. I have no say on the matter, I feel like security lax-ness makes sense for games, since jacking sessions with jwt is significantly less consequential and you have other sources…

Apple App Store Connect has this issue for example. If you remove or downgrade someone from the store they retain access for however long... and they keep the ability to do destructive actions like remove or change the permissions of other users, at least they used to until a year or so ago when I last checked. They closed my security report as "by design" btw.

Re: JWT is a scam and your app doesn't need it

#65

Post by Octoth0rpe »

CodeLieutenant wrote: post #55
Octoth0rpe wrote: post #30

I have a pile of personal criticisms of jwt, but I don't think this article does a great job of arguing against JWTs. For example: > You can't [invalidate a jwt]. That's the answer. The token is valid until it expires, full stop. The only way to invalidate it is to store the jti server-side in a revocation list and check that list on every single request. ...So the article says you can't invalidate a jwt, and not 2 s…

Yes you can invalidate them, but comes at the cost that you have to write the machinery yourself, that is the point. If you miss something, that's security issues, and I say you can't just because people are not doing it, dont know about it, or think ITS SIGNED, I DONT HAVE TO DO ANYTHING ELSE. Which is false pretenses. Also term invalidation is kinda tricky. YOU CANNOT INVALIDATE IT in a sense token is invalid. It's…

> Yes you can invalidate them

All I'm saying is that if you clearly can, then don't claim that you can't. Maybe claim it's inconvenient or impractical, but it's an absurd paragraph in the original article.

> True is unused feature, but then stateless part falls apart

Maybe a miscommunication, but that part of my comment was referring to validating the token on the client. I don't see how this makes them not stateless. The stateful/statelessness can be entirely confined to the server.

> My position here is, if I have to hit the database, well why then I need the signing part, or encryption part, whats the benefit of it.

It provides a useful token that can be validated once by some kind of front end application server, and then passed around from there to backend microservices which trust the validation from the front end app server. None of the backend microservices need to hit the database again. I tend to agree that the signing/encryption parts are not particularly useful, but that doesn't make jwt a scam (the premise of the article).

> yet for secure systems you have to store something, at least to be GDPR compliant. AFAIK you need to provide the feature LOGOUT FROM EVERYTHING by GDPR, dont quote me on that, it's what I've seen, not a lawyer, simple developer.

To do this minimally, you don't have to store anything under normal conditions. You only have to store the ids of revoked tokens, and only for the lifetime of the token that is invalidated.

Re: JWT is a scam and your app doesn't need it

#66

Post by znpy »

nathanmills wrote: post #16
grassfedgeek wrote: post #5

JWT can be short-lived, for example 1 hour. Then on each request if the token is nearing expiration you decide whether to extend it or not, and if so return a replacement JWT with extended expiration. With a short-lived JWT you don't need to invalidate the JWT. > just put the JWT in an httpOnly cookie You can have two cookies, one that is signed and httpOnly, and another that is unsigned and readable by JavaScript. B…

Let's say a friend sends you an exe file, a game they made. You run it, and immediately realize it wasn't actually your friend. The attacker has stolen your JWT session cookie. The attacker hasn't done anything yet - they are configuring their browser cookies to match yours. You go to invalidate your session / change your password, but it doesn't help. The attacker has a full hour to do whatever they want on your acc…

> Let's say a friend sends you an exe file, a game they made.

1995 called, they want their lame hacking tecniques back

Re: JWT is a scam and your app doesn't need it

#67

Post by tjansen »

nathanmills wrote: post #38
amarant wrote: post #32

Skill issue. I personally implemented the Minecraft Auth flow with JWT, and it handles ~250k req/s. It has the added benefit that already logged in users are unaffected if the Auth service goes down(Minecraft is a popular target for script kiddies and ddos attacks, so shit happens). The entire argument the article does about invalidation confirms this: the bit about 5 year tokens. You do automatic token refreshes, wh…

Can you explain how 30 minutes of unauthorized access is safe enough for most use cases? I feel like you glossed over that.

You can use a more nuanced approach.

What I did in the last systems I created:

1. The JWT expiration depends on the user. Admins get only 1 minute or so, but regular users 1 hour. If I had an SaaS for enterprise customers, I would use very short expiration times for paying enterprise users, but long for non-paying users.

2. When 95% of all requests are reads, and it's not sensitive data, only validate the JWT. For dangerous operations, always require validation of the user status.

3. I prefer to let the server control the JWT lifetime. So the server can respond to any request with a 'token too old' error, and the client knows it must renew it and retry. That allows you to configure the expiration date of the token depending on the operation and how critical it is.

Re: JWT is a scam and your app doesn't need it

#68

Post by dang »

Tiberium wrote: post #42
CodeLieutenant wrote: post #36

Earlier quoted context omitted.

It's not, it's just something that I've had problem with a long time. Not everything is AI generated, and I hate if someone writes AI articles especially something important like this. These are my general thoughts about it, everything here that I explained is the things I've seen in the wild, and what people are doing. I'm just fed up with it One thing that I did AI generate is the website itself. I really didn't ha…

[flagged]

Attacking another user like this is not acceptable, regardless of how/whether they used an LLM. It just adds poison to the site and community you're trying to defend. Please don't do that.

Users have different understandings of how to use LLMs appropriately. That's normal, since society is just beginning to figure this out. New users to HN should be welcomed, not attacked, and respectfully given information about local norms*.

This issue is complex with non-native English speakers, many of whom are using LLMs to try to improve their English. Often they aren't generating text outright but asking an LLM to edit it, and they don't realize that doing this can leave as many LLM imprints on their text as generating it outright.

What such users need is clear explanation and encouragement to write in their own voice (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...), not hostility and shaming from the community they just entered.

* The explanation part could go like this: (1) LLM-generated/edited comments aren't allowed on HN (https://news.ycombinator.com/newsguidelines.html); (2) the community mostly doesn't want to read LLM-generated/edited articles either; (3) there is little if any difference between using an LLM to edit text vs. generate it outright - the community will react much the same either way.

Re: JWT is a scam and your app doesn't need it

#69

Post by dang »

sevg wrote: post #60
CodeLieutenant wrote: post #59

Earlier quoted context omitted.

I'm not, first of all, English is not my first language and I dont see any problems with this sentence. This is not AI, and I'm not lying, but you can believe in whatever you want, I really dont care

[flagged]

(Normally I wouldn't duplicate a comment but this information applies equally to both your post and Tiberium's.)

Attacking another user like this is not acceptable, regardless of how/whether they used an LLM. It just adds poison to the site and community you're trying to defend. Please don't do that.

Users have different understandings of how to use LLMs appropriately. That's normal, since society is just beginning to figure this out. New users to HN should be welcomed, not attacked, and respectfully given information about local norms*.

This issue is complex with non-native English speakers, many of whom are using LLMs to try to improve their English. Often they aren't generating text outright but asking an LLM to edit it, and they don't realize that doing this can leave as many LLM imprints on their text as generating it outright.

What such users need is clear explanation and encouragement to write in their own voice (https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...), not hostility and shaming from the community they just entered.

* The explanation part could go like this: (1) LLM-generated/edited comments aren't allowed on HN (https://news.ycombinator.com/newsguidelines.html); (2) the community mostly doesn't want to read LLM-generated/edited articles either; (3) there is little if any difference between using an LLM to edit text vs. generate it outright - the community will react much the same either way.

Re: JWT is a scam and your app doesn't need it

#70

Post by minraws »

milch wrote: post #64
minraws wrote: post #43

Earlier quoted context omitted.

I think the perspective is most systems don't need validation based security, only access based security. So it's fine for some services to serve requests after the access has been revoked for a few extra minutes or seconds. For some it isn't. I have no say on the matter, I feel like security lax-ness makes sense for games, since jacking sessions with jwt is significantly less consequential and you have other sources…

Apple App Store Connect has this issue for example. If you remove or downgrade someone from the store they retain access for however long... and they keep the ability to do destructive actions like remove or change the permissions of other users, at least they used to until a year or so ago when I last checked. They closed my security report as "by design" btw.

Yeah had a similar experience with a Youtube dashboard auth thing, folks in big tech don't care well either does my manager, it doesn't add to my KPIs and making things secure by making customer experience worse is just a product killer apparently and gets shot down real quick.

Honestly all this just makes me feel tired, like real tired, I honestly wished Mythos would set the software world on fire, some folks and companies deserve to burn.

But then I saw it's output and well.. I have KPIs to hit and a LLM slot machine lever to pull.

Post reply on HN