News for hackers. Stuff that matters.

A comment on Ask HN: What's the current sentiment on JWT for stateless auth tokens?. Parent comment

Re:Ask HN: What's the current sentiment on JWT for stateless... by alboy on Friday December 13, 2019 @05:42PM (#21786297)
All such tokens would be effectively revoked anyway since you check the iat timestamp (or lack thereof) at the authorization point.
[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by jacobr1 on Friday December 13, 2019 @06:18PM (#21786531)
Yep, and that is what we do. But we also check to ensure that a secure cipher was used, not none. Many of the "JWT is insecure" type articles (and real vulnerabilities found) were based on the fact that people just used dumb defaults and didn't secure things. So the argument is really that JWT is a footgun without some adult supervision.
[ Parent | on HN ]