JSON Web Tokens should be avoided

Re:JSON Web Tokens should be avoided by lclarkmichalek on Tuesday March 14, 2017 @09:39AM (#13867348)

What should I use instead? I pass around JWTs attached to HTTP requests that represent an authenticated user, and contain things such as a user's email, groups, scopes etc. I've tried to keep it simple (RSA, SHA256, nothing interesting), and use the subset of JWT that seems sane (basically the bits I see Google using in their JWT based OAuth flow)

I used JWTs because

1. I like the statelessness of JWTs (though I've learnt that there are many trade offs related to this)

2. OAuth uses JWTs, Google uses OAuth, and Google usually know what they're doing

3. I can attach custom claims

4. I don't know of any alternatives, other than x509, which I have less confidence on me being able to validate correctly than JWTs.

What would you suggest? An opaque token which I then look up against a central database/api?

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by zeveb on Tuesday March 14, 2017 @02:20PM (#13870039)

SPKI (RFCs 2692 & 2693) offers a well-developed, well-thought-out framework which meets all your needs: SPKI certificates can contain state, and thus support server statelessness; SPKI certificates can be used as OAuth tokens; SPKI certificates support custom claims (and in fact go so far as to define a well-formed claim calculus which can be implemented easily, and which supports just about anything one would wish to do); and SPKI certificates are far, far simpler than X.509.

Take a look: https://tools.ietf.org/html/rfc2692 & https://tools.ietf.org/html/rfc2693

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by tptacek on Tuesday March 14, 2017 @09:43AM (#13867370)

You're in luck! As I pointed out in the comment you replied to, JWT includes X.509.

[ Parent | on HN ]