News for hackers. Stuff that matters.
Re:JSON Web Tokens should be avoided by tptacek on Tuesday March 14, 2017 @12:53PM (#13869193)
Or just use Fernet:

https://github.com/fernet/spec/blob/master/Spec.md

Fernet was written originally for Python but there's a Ruby implementation, a Golang implementation, and a Clojure implementation. I believe that for at least 80% of applications considering JWT, Fernet provides exactly the right amount of functionality, and does so far more safely than JWT.

Re:JSON Web Tokens should be avoided by Flenser on Wednesday March 15, 2017 @07:01AM (#13875222)
Since it's not linked from any https://github.com/fernet/ project as far as I could tell, and I had to google for it.

Clojure implementation:

https://github.com/derwolfe/fernet-clj

I also found a JavaScript implementation:

https://github.com/csquared/fernet.js

Re:JSON Web Tokens should be avoided by mst on Tuesday March 14, 2017 @03:26PM (#13870674)
This looks very much like the approach to session-data-in-encrypted-and-signed-cookie I've seen used to great success in lots of places (where for a stateless-ish API the contents are just a user id or whatever).

Am I right that this would work fine both in that or in e.g. a query parameter?

(sorry if I'm asking really stupid questions, but I'd rather look stupid than accidentally a security hole)