News for hackers. Stuff that matters.

A comment on Ask HN: What's the current sentiment on JWT for stateless auth tokens?. Parent comment

Re:Ask HN: What's the current sentiment on JWT for stateless... by rvz on Friday December 13, 2019 @02:22PM (#21784498)
So now every user has to log back in again every time you upgrade your server, simply changing the signing key or when your backend gets compromised.

Additionally JWEs don't support forward-secrecy meaning that I can MITM and collect all JWEs passing through, find the key in your compromised backend and decrypt ALL these collected tokens.

No need to do this with JWTs since they're unencrypted by default.

[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by JMTQp8lwXL on Friday December 13, 2019 @02:27PM (#21784535)
Your server shouldn't be getting compromised on a regular basis. The occasional black swan event occurs, and sometimes you have no other choice.
[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by staticassertion on Friday December 13, 2019 @03:07PM (#21784911)
Users get compromised though and will want to revoke sessions. But this is why you just set a time limit on your JWT, so that they can revoke and within N minutes the old sessions will die. Just keep N low.
[ Parent | on HN ]