JSON Web Tokens should be avoided

Re:JSON Web Tokens should be avoided by theptip on Tuesday March 14, 2017 @02:21PM (#13870048)

So every user on your system has to reauthenticate if one client token is compromised? That seems like an invitation to a thundering herd. Not necessarily fatal, but I'd consider it a nice feature to not have to invalidate everybody's tokens to get at one.

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by Alex3917 on Tuesday March 14, 2017 @02:25PM (#13870101)

> So every user on your system has to reauthenticate if one client token is compromised?

No, because you would also store either a separate datetime or uuid on each user model. And if just one user has their credentials compromised, then you would bump the date or generate a new UUID for just that user.

The global datetime would only be bumped if some site wide vulnerability were found.

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by igl on Tuesday March 14, 2017 @04:25PM (#13871152)

So there is a db roundtrip involved? Like a inverted session. Whats the point of using jwt then?

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by Alex3917 on Tuesday March 14, 2017 @04:39PM (#13871270)

For most web frameworks, the user model gets retrieved from the db automatically whenever an authenticated request is made. So there is no extra lookup.

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by igl on Wednesday March 15, 2017 @03:45AM (#13874466)

Oh man.

Proponents say critics dont offer alternatives at the same time they always literally 'reverse' engineered sessions if you dig deep enough.

I give up. JWT is just a hip thing to do right now. :(

[ Parent | on HN ]

Re:JSON Web Tokens should be avoided by theptip on Tuesday March 14, 2017 @02:46PM (#13870287)

Got it, didn't catch that you were referring to storing that timestamp per-user.

That's what I do in my system.

[ Parent | on HN ]