Ask HN: What do you use for authentication and authorization?

Re:Ask HN: What do you use for authentication and authorizat... by jondubois on Thursday December 27, 2018 @09:59AM (#18769756)

This is not accounting for reconnect scenarios. With sessionId, if the user loses the connection and reconnects, there will need to be another DB lookup to verify that the sessionId is valid. This is not the case with JWT. The validity of the JWT can be checked without any DB lookups.

Also, this is a security consideration because a malicious user could intentionally send fake sessionIds to make us DoS our database. With JWT, verification of the signature only uses CPU on the workers which are easier to scale.

[ Parent | on HN ]

Re:Ask HN: What do you use for authentication and authorizat... by ynniv on Thursday December 27, 2018 @12:20PM (#18770863)

You can sign session ids to prevent DoS, and you can cache session ids to avoid database lookups, but you can't detect forged or stolen JWT tokens.

[ Parent | on HN ]

Re:Ask HN: What do you use for authentication and authorizat... by nmgsd on Saturday December 29, 2018 @12:22PM (#18784596)

You can't forge a JWT without stealing the private key of the valid JWT signer.

You can steal a JWT token the same way you can steal a session token.

[ Parent | on HN ]

Re:Ask HN: What do you use for authentication and authorizat... by throwawaymath on Thursday December 27, 2018 @11:55AM (#18770645)

Why wouldn’t you rate limit connections? That is something you should be doing anyway, and it neatly resolves the denial of service problem.

[ Parent | on HN ]