News for hackers. Stuff that matters.

A comment on Ask HN: What do you use for authentication and authorization?. Parent comment

Re:Ask HN: What do you use for authentication and authorizat... by michaelt on Thursday December 27, 2018 @09:05AM (#18769484)
I don't know what stack you're working with that makes you say re-issuing JWT every 50 seconds over WebSockets is simpler to implement than the session ID approach people have been using for 20+ years :)
[ Parent | on HN ]
Re:Ask HN: What do you use for authentication and authorizat... by nine_k on Thursday December 27, 2018 @01:17PM (#18771259)
Simpler != cheaper WRT resource consumption. Not having to hit a DB means not having to replicate the DB to respond quickly, and having one fewer point of failure.

If you can live with quickly expiring, quickly reissued crypto tokens like JWT, it's a boon.

But JWT definitely don't work for web auth. They can be used as CSRF tokens, though.

[ Parent | on HN ]