JWT is Awesome
thehftguy.com
JWT is Awesome
1–10 of 170 posts
Re: JWT is Awesome
#2Re: JWT is Awesome
#3"Pro: JWT is secure"
Yes, but I see a lot of implementations where the token is sent to JavaScript and is stored there.
It's best to store it as secure cookie (HttpOnly) so JavaScript cannot access it.
Re: JWT is Awesome
#4Was about to write a rant that it's still not better than cookies & sessions, something that has been standard waay longer than JWT.
But this video says all I have to say (2018):
https://www.youtube.com/watch?v=JdGOb7AxUo0
1 sec takeaway (More in the video):
https://i.imgur.com/vUYTYfS.png
That said, JWT's are great for stuff like 2-Factor via email link or redirecting from one domain to another. Single use, which it was built for.
Re: JWT is Awesome
#5Counterpoint: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...
I'm impressed that you put your money where your mouth is and built & marketed an alternative: https://paseto.io/
Anyone here got experience using Paseto in anger? (besides CiPHPerCoder who made it)
I would love a JWT-like thing that's equally common yet better designed. But especially when using it in public APIs and the likes, acceptance has to be pretty broad. Anyone got insights as to how mainstream Paseto is getting?
Re: JWT is Awesome
#6„9) Myth: JWT doesn’t support logout or invalidation. (It can with OpenID Connect)“
Iterating on how invalidation work with OpenID Connect when in a point before the author said an authentication service which can go down is a single point of failure you should avoid. So he added a spof by using openid connect...
Re: JWT is Awesome
#7This article is conflating the benefits of a particular way of doing implementation, and JWT as an implementation of that approach to authentication. That's dangerous because it n
discourages people from thinking carefully about the semantics involved. Authentication is a topic where the trade-offs should be carefully evaluated for your particular situation.
I do agree that if you need the particular way of doing authentication that JWT is designed for, JWT is indeed a great implementation and can save you a lot of time.
Re: JWT is Awesome
#8Counterpoint: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...
I'm impressed that you put your money where your mouth is and built & marketed an alternative: https://paseto.io/ Anyone here got experience using Paseto in anger? (besides CiPHPerCoder who made it) I would love a JWT-like thing that's equally common yet better designed. But especially when using it in public APIs and the likes, acceptance has to be pretty broad. Anyone got insights as to how mainstream Paseto is get…
> Anyone got insights as to how mainstream Paseto is getting?
Okta's a pretty big name in authn/authz and their engineers recently published an open source PASETO implementation.
https://developer.okta.com/blog/2019/10/17/a-thorough-introd...
Re: JWT is Awesome
#9JWT can be used as cross server auth
sign in on www.example.com -> click visit www.example2.com while being logged onto accout based on example
Re: JWT is Awesome
#10Counterpoint: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...
I'm impressed that you put your money where your mouth is and built & marketed an alternative: https://paseto.io/ Anyone here got experience using Paseto in anger? (besides CiPHPerCoder who made it) I would love a JWT-like thing that's equally common yet better designed. But especially when using it in public APIs and the likes, acceptance has to be pretty broad. Anyone got insights as to how mainstream Paseto is get…
Judging from the number of stars of the various git repositories for different languages, there are a few people using it but not a whole lot. The most popular implementation seems to be php based. That suggest to me it's still early days for this. E.g. the Java implementation only has 13 stars, which is not a lot. Also it has a native dependency, which is not ideal. E.g. JWT has a pure Java implementation from oauth0.
JWT has been out there for a few years and there are many uses of it that are fine. I've used it in the past and it was easy set up and get started with. The main criticism seems to be that users have too much wiggle room to do silly things like using alg=noneor that certain widely used algorithm combinations have some weaknesses. I guess that's valid but not a huge concern if you know what you are doing.
Paseto looks like it improves by narrowing down the choices to some sane choices, which is a valid approach. Of course IETF could update the relevant RFCs to use the same algorithms for JWT at some point.