Ask HN: What's the current sentiment on JWT for stateless auth tokens?

Re:Ask HN: What's the current sentiment on JWT for stateless... by rvz on Friday December 13, 2019 @01:57PM (#21784310)

Today I would still use alternatives like PASETO [0] or Branca [1] tokens which the latter is a fernet-like secure alternative to JWTs.

The problem with JWTs is that they are discouraged by many cryptographers due to their "cryptographic agility" and provide a mixture of protocols which includes weak ciphers and configurations to shoot the programmer in the foot. Why include insecure ciphers in the first place? The mentioned alternatives stick to a single cipher for its intended purpose.

JWTs are inefficient for performance and are bloated in their data structure and have a performance hit when you parse the token to extract its properties compared with the same operation in other alternatives (simple session cookie require zero parsing and thus is faster).

And using them for sessions poses it own pitfalls [2] which you are better off with the alternatives or plain old session cookies.

They say that JWTs are "good when used right" but with those above footguns, that's like saying C++ is safe when used right, rather than having safe defaults.

[0] https://paseto.io/

[1] https://branca.io/

[2] http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-fo...

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by GordonS on Saturday December 14, 2019 @05:38AM (#21788806)

> JWTs are inefficient for performance and are bloated in their data structure and have a performance hit when you parse the token to extract its properties compared with the same operation in other alternatives (simple session cookie require zero parsing and thus is faster)

While a session ID doesn't require parsing, it is useless on it's own; a fairer comparison would be: time to validate and parse/deserialize a JWT vs time to retrieve session data from the backing store (e.g. database, redis).

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by cordite on Friday December 13, 2019 @02:25PM (#21784514)

Another interesting one is Macaroons [1], although the implementations have not had much activity since 2014.

[1] https://ai.google/research/pubs/pub41892

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by justincormack on Friday December 13, 2019 @07:14PM (#21786860)

See https://github.com/CleverCloud/biscuit/blob/master/README.md for a newer take on macaroons.

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by cordite on Saturday December 14, 2019 @05:24PM (#21792739)

This is very interesting! Although it is very much a draft in progress.

It also references a new one I haven’t seen before, https://vanadium.github.io/concepts/security.html

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by GordonS on Saturday December 14, 2019 @05:41AM (#21788811)

I've come across PASETO before, but never heard of Branca before.

I certainly like the lack of footguns in PASETO, but I'm curious about how much real-world adoption it (or indeed other JWT alternatives) really have?

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by duelingjello on Tuesday December 17, 2019 @04:23AM (#21811998)

Popularity is never evidence of rigor or soundness. Lots of people do dumb things like lemmings.

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by GordonS on Tuesday December 17, 2019 @05:33AM (#21812328)

While I like the sentiment, it's a little naive; I want to use something that's got real community traction, and is going to be around long-term.

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by JaviFesser on Monday December 16, 2019 @05:30AM (#21802116)

Oh! I love fernet (not the library, but the alcoholic beverage)

[ Parent | on HN ]