Re:JSON Web Tokens should be avoided
by fovc on Tuesday March 14, 2017 @08:55AM
(#13867089)
It's not that need an RFC standardized solution for everything, but I'd rather not roll my own anything related to crypto. Would something like crypto_auth(json(bag)) be better here?
(crypto_auth from libsodium, json being sorted without whitespace)
[ Parent
| on HN ]
Yes, that would be much better, and it's what I mean when I say that JWT doesn't bring anything to the table.
"json being sorted without whitespace"
What is the significance of that part?
It makes JSON deterministic, which it isn't by default (e.g. {"foo": 1, "bar": 2} and {"bar":2,"foo":1} are both valid serialisations.
Of course, it'd be better still to use a format _meant_ to provide human-readable canonical representations of data, e.g. Ron Rivest's canonical S-expressions (http://people.csail.mit.edu/rivest/Sexp.txt), but of course this is information technology and we have to reinvent the wheel — usually as an irregular polygon — every 3-4 years rather than using techniques which are tried and true.
Ah yes, similar to canonicalization of XML for XMLSignature?
Presumably this means that you have to have have a "flat" JSON structure rather than lots of nested objects and arrays?