News for hackers. Stuff that matters.

A comment on JSON Web Tokens should be avoided. Parent comment

Re:JSON Web Tokens should be avoided by gregpardo on Tuesday March 14, 2017 @08:55AM (#13867088)
For number 2, you could expire them by encoding some identifier based off a hash or key tied to the user object. Change that object and have the server reject the token if that meta data no longer validates.
[ Parent | on HN ]
Re:JSON Web Tokens should be avoided by tracker1 on Tuesday March 14, 2017 @02:39PM (#13870231)
Or have really short lived tokens, requiring regular refresh, and don't worry about expiring them... you can then delete the refresh token so it can't be found requiring full re-auth if necessary.

OAuth2 + JWT is fine... just whitelist the algorithms you allow and use HTTPS for all communications, even internal.

[ Parent | on HN ]