Authentication with Django and Single Page Apps (2020)
mikesukmanowsky.com
Authentication with Django and Single Page Apps (2020)
1–10 of 39 posts
Re: Authentication with Django and Single Page Apps (2020)
#2I pretty much agree with the sentiment of this post.
I’ll probably get downvoted for saying this . . .
Ever since using JWT’s became a trend, I’ve found that I can’t get a useful answer almost every single time I’ve asked an engineer (or team) why they picked JWT’s over old, boring, and tested sessions for a web app. It seems, just like React, GraphQL, etc., a lot of the industry just love jumping on bandwagons. I see so many companies adopting the new and shiny thing (or the thing attached to a big name) rather than the best tool for the job. Unless I encounter a specific use case that would be best served using JWT’s, I’ll stick with the “old” Redis sessions model.
I guess you’re not a real engineer nowadays if you can’t say that your new app uses insert buzzword or trendy technology here . . .
Re: Authentication with Django and Single Page Apps (2020)
#3I pretty much agree with the sentiment of this post. I’ll probably get downvoted for saying this . . . Ever since using JWT’s became a trend, I’ve found that I can’t get a useful answer almost every single time I’ve asked an engineer (or team) why they picked JWT’s over old, boring, and tested sessions for a web app. It seems, just like React, GraphQL, etc., a lot of the industry just love jumping on bandwagons. I se…
I think the original motivation was tied to when people were trying to build unified APIs for every kind of client: web, mobile, m2m. Cookies and sessions werent always available afaik.
Re: Authentication with Django and Single Page Apps (2020)
#4I pretty much agree with the sentiment of this post. I’ll probably get downvoted for saying this . . . Ever since using JWT’s became a trend, I’ve found that I can’t get a useful answer almost every single time I’ve asked an engineer (or team) why they picked JWT’s over old, boring, and tested sessions for a web app. It seems, just like React, GraphQL, etc., a lot of the industry just love jumping on bandwagons. I se…
The use of trusted jwt libraries which outsource registration and authentication has massive benefits such as SSO and reducing the risk of vulnerabilities (user reg/auth being handled by a dedicated party).
There’s no reliance on a database or state management, which can be useful under some conditions.
In my eyes, the problem is reliance of the authorisation header instead of cookies, this has some benefits but is also a massive deviation away from 20 years of websec. Granted all of http spec is a giant nasty hack, so it’s not really jwts fault.
Re: Authentication with Django and Single Page Apps (2020)
#5hahaha, let's go back to 1998 and use cookies and sessions for authentication.
seriously, use time-based and hmac-based one time passwords. combine them with the user's email, which is a strong guarantee for identity and uniqueness. if the user chooses to use a disposable email, it becomes their problem, not yours.
Re: Authentication with Django and Single Page Apps (2020)
#6Now… let’s just cover SAML. How do these methods congrue with SAML? I guess maybe all of this (token, etc…) is issued _after_ a SAML “handshake” is complete?
Re: Authentication with Django and Single Page Apps (2020)
#7hahaha, let's go back to 1998 and use cookies and sessions for authentication. seriously, use time-based and hmac-based one time passwords. combine them with the user's email, which is a strong guarantee for identity and uniqueness. if the user chooses to use a disposable email, it becomes their problem, not yours.
Huh? Sessions and TOTP aren’t mutually exclusive. In fact, they work quite well together.
And since when were cookies and sessions 1998-level technology? That’s ridiculous.
Re: Authentication with Django and Single Page Apps (2020)
#8I pretty much agree with the sentiment of this post. I’ll probably get downvoted for saying this . . . Ever since using JWT’s became a trend, I’ve found that I can’t get a useful answer almost every single time I’ve asked an engineer (or team) why they picked JWT’s over old, boring, and tested sessions for a web app. It seems, just like React, GraphQL, etc., a lot of the industry just love jumping on bandwagons. I se…
I don't think it's a trend or that people are trying to be cool or something. JWT is like a simpleton version of Kerberos/ActiveDirectory tickets. Having authentication and/or authorization independent of operational systems has significant advantages is architecture and deployments.
Re: Authentication with Django and Single Page Apps (2020)
#9I pretty much agree with the sentiment of this post. I’ll probably get downvoted for saying this . . . Ever since using JWT’s became a trend, I’ve found that I can’t get a useful answer almost every single time I’ve asked an engineer (or team) why they picked JWT’s over old, boring, and tested sessions for a web app. It seems, just like React, GraphQL, etc., a lot of the industry just love jumping on bandwagons. I se…
I think the original motivation was tied to when people were trying to build unified APIs for every kind of client: web, mobile, m2m. Cookies and sessions werent always available afaik.
I was under the impression sessions were just arbitrary tokens backed by some server-side logic (or perhaps a database)
At its core isn't it possible to just take an object, encrypt it with a secret, store it client-side somewhere (cookies, localstorage, filesystem, printed-on-paper, whatever), send it back to the server, and it decrypts it?
I don't quite see the difference (or benefits) of JWTs over something like that.
Re: Authentication with Django and Single Page Apps (2020)
#10A lot of bad arguments against JWT tokens. These items are definitely something you can address with JWT token:
* expiration date
* invalidation
* change of roles or any significant change in user attributes
Moe important, the list of issues would be the same for a session cookie: if you don't expire the session on the back-end or reflect changes in the user attributes, same issue.
Basically, apply the same best practices for session tokens or JWT token and you'll be fine. You can also put the JWT toke in the cookie, it does not have to be stored in the browser local stroage.