News for hackers. Stuff that matters.

A comment on Revoking JWTs (JSON Web Tokens). Parent comment

Re:Revoking JWTs (JSON Web Tokens) by jakelazaroff on Thursday January 31, 2019 @02:10PM (#19047720)
Are people really running into such terrible scaling issues with their session database that the solution is to ditch it and use an entirely different authentication strategy? It's not like we haven't been scaling databases for decades!

I agree that persisting the JWT means you may as well be using a session, but my takeaway from that is that you should just use a session, not come up with more weird workarounds to justify JWTs.

[ Parent | on HN ]
Re:Revoking JWTs (JSON Web Tokens) by brokenwren on Thursday January 31, 2019 @03:25PM (#19048443)
Randall Degges has a blog post on this. It's pretty good actually: https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-...
[ Parent | on HN ]
Re:Revoking JWTs (JSON Web Tokens) by robotdan on Thursday January 31, 2019 @03:15PM (#19048356)
I'd say it is always good to have options. If sessions work, that is a safe option and easy to manage state.

If at scale this option doesn't work - or at least not as well as you'd like, additional strategies are good to know.

If you plan for Pokemon Go, or Fornite scale, decoupling may be beneficial. Admittedly this is a small percentage of all of the use cases.

[ Parent | on HN ]