Re:Ask HN: What's the recommended method of adding authentic...
by beckler on Tuesday January 16, 2018 @03:41PM
(#16162293)
You can't prematurely expire or invalidate JWT tokens once created, unless you keep a database of tokens, and at that point you should just use sessions because that's basically what it is at that point: A session token with additonal data.
Re:Ask HN: What's the recommended method of adding authentic...
by 013a on Tuesday January 16, 2018 @05:18PM
(#16163255)
That doesn't mean JWTs are bad; it just means their use case is more restrictive. JWTs are designed for sessions; think Google API tokens that have a validity of 1 hour. If you're using them for anything longer than that, then you'll probably need to back it with a database so you can support revocation, and at that point JWTs make less sense because they're so large.
Re:Ask HN: What's the recommended method of adding authentic...
by hungerstrike on Tuesday January 16, 2018 @02:29PM
(#16161417)
I can’t fathom what the problem could be when using private key encryption to create stateless tokens.
I do this to create bearer tokens without JWT.
Anyway, you can find a lot of his comments about JWT by searching ‘tctapek JWT site: ycombinator.com’
Can we get more intel behind why JWT is bad? I've always been told that as long as you explicitly check both the signature and that the signature algorithm type is what you expect, its fine. Libraries tend to make the mistake of not doing that second part for you, so implementations have to be aware of that.
The one concern I've always had is that even though they are stateless, most implementations end up making a db request to get info about the user anyway (i.e. their role and permissions), so the stateless advantage of JWT isn't as big as it is touted. You can embed that into the JWT, but then the token inevitably gets huge.