Re:Stop using JWT for sessions (2016)
by justaaron on Thursday November 01, 2018 @06:55PM
(#18359204)
what i propose:
1) login = sending username and hashed password (over tls) that does a bcrypt etc, compares to bcrypted etc hash in db, if correct = provide a jwt set as a cookie with "secure httpOnly", jwt should be logged.
2) logout = request to server, server sets cookie with "token=empty;expires:1970yaddayadda" as it's httpOnly there's no client-side messing baout with the cookie otherwise
3)_all pages send cookie with each request, so must be tls
upon logout, cookie has empty token, must be re-set with new token. old token, if stolen, can be compared with logged history, etc.
2) logout = request to server, server sets cookie with "token=empty;expires:1970yaddayadda" as it's httpOnly there's no client-side messing baout with the cookie otherwise
3)_all pages send cookie with each request, so must be tls
upon logout, cookie has empty token, must be re-set with new token. old token, if stolen, can be compared with logged history, etc.
what do you see, in terms of flaws?