JWT is a scam and your app doesn't need it
dusanmalusev.dev
JWT is a scam and your app doesn't need it
1–10 of 70 posts
Re: JWT is a scam and your app doesn't need it
#2Eh. JWTs are super handy if you have a single web experience spread across multiple backend apps on the same domain, with a single SSO server to set up the user auth. Definitely not for storing anything sensitive, but treating it like a fancy session cookie with the minimal amount one needs to securely access resources - customerId or whatever - makes life a lot easier than trying to wire up cookie / session management across a lot of different, disparate apps.
Re: JWT is a scam and your app doesn't need it
#3> I am tired of pretending JWT is fine.
I don't get it. Why were you lying to people??? Why were you pretending? Thats not healthy and pretty anti-social.
Re: JWT is a scam and your app doesn't need it
#4JWTs are very helpful if you maintain many downstream services on separate domains that need shared auth and identity infrastructure
Re: JWT is a scam and your app doesn't need it
#5JWT can be short-lived, for example 1 hour. Then on each request if the token is nearing expiration you decide whether to extend it or not, and if so return a replacement JWT with extended expiration. With a short-lived JWT you don't need to invalidate the JWT.
> just put the JWT in an httpOnly cookie
You can have two cookies, one that is signed and httpOnly, and another that is unsigned and readable by JavaScript. Both contain the same information. So JavaScript can read the information in the second cookie, but since it is unsigned, exfiltrating the cookie doesn't compromise security.
Re: JWT is a scam and your app doesn't need it
#6K, I'll stop authorizing incoming OAuth 2 requests to Amazon AgentCore by validating JWTs before allowing access to agents and gateways.
Re: JWT is a scam and your app doesn't need it
#7The same criticism can be leveled against a signed session token. Also comparing decryption with a local redis get which is still much slower is wrong. The criticism against long expiration is valid but that is not unique to JWT, and token refresh is not a "patch" on a broken system. This is just way off on everything
Re: JWT is a scam and your app doesn't need it
#8[deleted]
Re: JWT is a scam and your app doesn't need it
#9Who’s still on x86 in 2026?
Re: JWT is a scam and your app doesn't need it
#10I think JWT-like schemes can enable better machine-to-machine integration.
If you drink all of the koolaid, you can wind up with a system where two different parties securely authenticate sessions without any kind of secrets ever needing to be provided directly. Both parties generate and retain private key material in an HSM and perform signing ops there. The only thing that has to be trusted is the subject of the certificates. Keys can be rotated arbitrarily and the counterparty should not have any issues with this, assuming the standards are followed.
Short lifetime is the best solution to concerns around revocation. The vendor I last integrated with has their opaque tokens expire after 15 minutes. Immediate revocation sounds preferable but in practice there are other controls that will typically compensate for any gaps here (i.e., audit logs & the police). If you are firing someone and you think they might do a really bad thing that the business could never recover from, you should probably disable their accounts about an hour before the call with HR.