Show HN: PAST, a secure alternative to JWT

Re:Show HN: PAST, a secure alternative to JWT by AndrewStephens on Thursday January 04, 2018 @01:47PM (#16072901)

Forgive my ignorance, but if you are going to all the trouble of storing the JWT id in a server side database for verification why don't you just store the JWTs' claims as well and just hand the client an opaque random id? Your gateway could do the lookup and supply the claims to your backend without the client knowing anything about it. You wouldn't even have to validate the claims, since they never leave your servers.

The best part of using JWTs is that you can validate without a central database. If you need a central database for sessions anyway you might as well store the claims in it.

[ Parent | on HN ]

Re:Show HN: PAST, a secure alternative to JWT by allyant on Friday January 05, 2018 @04:04AM (#16077472)

Good solution! Openresty could create the JWT and add it to the forwarding headers, although the user would still need a cookie to maintain session with the proxy.

Only disadvantage I could see would be performance.

[ Parent | on HN ]