News for hackers. Stuff that matters.

A comment on JSON Web Tokens should be avoided. Parent comment

Re:JSON Web Tokens should be avoided by tptacek on Tuesday March 14, 2017 @11:54AM (#13868571)
I don't care about these moral arguments. I'm making a simple, positive claim: JWT is bad. You can blame whoever you'd like for it being bad, but as engineers, you need to understand first and foremost that JWT is bad, and reckon with your feelings about that later.

You have a responsibility to built trustworthy systems, and you get no pass on building with flawed components simply because you wish experts had made those components less flawed.

[ Parent | on HN ]
Re:JSON Web Tokens should be avoided by contrast on Wednesday March 15, 2017 @04:28AM (#13874639)
"Contribute to standards processes" and "don't roll your own" aren't moral arguments. They're complimentary pieces of practical advice on how to make trustworthy systems.

Meanwhile your comments bury whatever substantive content they might hold under layers of emotional, accusatory garbage. Maybe get those feelings locked down a bit before posting?

[ Parent | on HN ]
Re:JSON Web Tokens should be avoided by Alex3917 on Tuesday March 14, 2017 @01:00PM (#13869269)
Do you have any recommendations for SPAs where the API is hosted on a different subdomain than www? I think everyone agrees that JWT is a bad spec, the problem is that setting cookies across subdomains ranges from difficult to impossible.

If you have access to an experienced devops team who can securely maintain an nginx server with some proxy logic then maybe that's a possibility, but otherwise what other viable options are there? Wishing that JWT were more secure won't make it so, but neither will wishing that CORS were more flexible. And if it's a choice between subclassing the JWT handlers to provide a couple extra security checks vs trying to securely configure and maintain a whole extra proxy setup, then the former seems like the lesser of the evils.

[ Parent | on HN ]
Re:JSON Web Tokens should be avoided by caivvoacmh on Wednesday March 15, 2017 @11:46AM (#13876879)
Does this mean that using AWS Cognito [1] is out of the question since it uses JWT? Unfortunately, you can't change what the service uses as it's all under Amazon's control.

[1]: https://docs.aws.amazon.com/cognito/latest/developerguide/am...

[ Parent | on HN ]
Re:JSON Web Tokens should be avoided by danjoc on Tuesday March 14, 2017 @12:20PM (#13868842)
I have no feelings on the subject. I don't use JWT. I just want to point out this sounds like (and continues to sound like) "Roll your own" advice to me.
[ Parent | on HN ]