JSON Web Tokens vs. Sessions

Re:JSON Web Tokens vs. Sessions by hharnisch on Saturday June 18, 2016 @02:14PM (#11929862)

JWT is especially useful for validating requests in a microservice architecture. You can pass around the token an embed roles in them. No need to keep a session store with them!

[ Parent | on HN ]

Re:JSON Web Tokens vs. Sessions by hharnisch on Saturday June 18, 2016 @02:17PM (#11929878)

On another note I've been working on a service that generates expirable/refreshable JWTs. Its a good way to start trying them out https://github.com/hharnisc/auth-service

[ Parent | on HN ]

Re:JSON Web Tokens vs. Sessions by joepie91_ on Saturday June 18, 2016 @05:52PM (#11930776)

Better remove that again. It is extremely dangerous to store any kind of credential in Local Storage. Cookies are the (only) correct place for storing credentials.

[ Parent | on HN ]

Re:JSON Web Tokens vs. Sessions by areed on Saturday June 18, 2016 @09:41PM (#11931478)

Because you can set Secure and HttpOnly flags on cookies? This merely brings them up to the same level of security you get with Local Storage. http://blog.portswigger.net/2016/05/web-storage-lesser-evil-...

[ Parent | on HN ]

Re:JSON Web Tokens vs. Sessions by pags on Sunday June 19, 2016 @10:24AM (#11933053)

What is a "level" of security? If I'm able to inject arbitrary code into your page, with it I can access your local storage data, but I can't access your "http only" cookies - so there's at least some "level" of difference.

[ Parent | on HN ]

Re:JSON Web Tokens vs. Sessions by garfij on Sunday June 19, 2016 @05:05PM (#11934671)

If you're at the point where someone can inject random code into your site, you've already lost and have so many more problems than access to localStorage.

[ Parent | on HN ]