News for hackers. Stuff that matters.

A comment on How to Use JSON Web Tokens. Parent comment

Re:How to Use JSON Web Tokens by techslave on Wednesday January 02, 2019 @01:45PM (#18808784)
not sure if that was the point or not, but it's wrong. even if you did sign/encrypt, that's not a benefit over a standard cookie. you can easily sign or encrypt a 'standard cookie' as well.

the benefit is the portability that comes from a standardized and widely used data structure.

[ Parent | on HN ]
Re:How to Use JSON Web Tokens by kbenson on Wednesday January 02, 2019 @02:11PM (#18809016)
You say that as if cookies haven't been a standardized and widely used data structure (key-value store) for decades.
[ Parent | on HN ]
Re:How to Use JSON Web Tokens by johncolanduoni on Wednesday January 02, 2019 @03:59PM (#18810133)
No, they say it as if cookies don’t have a built in authentication or encryption method (when the client is untrusted).
[ Parent | on HN ]
Re:How to Use JSON Web Tokens by KaiserPro on Thursday January 03, 2019 @05:03AM (#18814046)
My point was that allowing 'None' was/is a flaw. If you want to shuttle bits of data about in an unsigned/unencrypted/insecure way, that's what raw cookies are for.

Now, as cookies are buckets to dump data, there is of course nothing to stop you encrypting, signing and doing all sorts of things to cookies.

[ Parent | on HN ]