News for hackers. Stuff that matters.

A comment on Ask HN: What's the current sentiment on JWT for stateless auth tokens?. Parent comment

Re:Ask HN: What's the current sentiment on JWT for stateless... by ceejayoz on Friday December 13, 2019 @02:25PM (#21784523)
The issue is not remembering the password.

The issue is I just logged in 90 seconds ago, typed up a few paragraphs, and when I go to submit I have to do it again, because someone in another company using the tool got phished and needs a new password.

It's frustrating enough when Gmail makes me put my password in after 30 days and I just clicked into an email I wanted to read. Having it happen all day long would make me want to kill someone.

[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by JMTQp8lwXL on Friday December 13, 2019 @02:28PM (#21784549)
I wasn't suggesting mutating the signing key multiple times per day or once per 90 seconds. At that point, you might as well just have a very early JWT expiration timestamp specified.
[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by ceejayoz on Friday December 13, 2019 @02:33PM (#21784600)
The comment thread started with "if you need them to be revocable". Any tool with "a few hundred [enterprise] customers" needs to be able to revoke access for terminated employees, compromised accounts, and the like, and those revocations will occur frequently and in many cases need to have immediate impact.
[ Parent | on HN ]