Ask HN: What's the current sentiment on JWT for stateless auth tokens?

Re:Ask HN: What's the current sentiment on JWT for stateless... by jakelazaroff on Friday December 13, 2019 @11:22PM (#21787799)

I don’t understand your explanation, but the words that you’re using (e.g. “purges”, “cache”) indicate that you’re describing a stateful system.

Imagine you’re writing your API on AWS Lambda, so memory and the file system are not shared between requests. A client presents your API with a token. Using no external resources (no database hits, no network requests, etc) how do you determine the veracity of that token?

Edit: I think I understand what you’re saying. Using a CDN that will let you “tag” resources and conditionally provide access based on whether HTTP headers match those tags, you issue tokens to clients and add or remove tags to give and revoke access. The CDN determines whether a given tag can access the resource, and your application doesn’t worry about authentication.

This is still stateful. The tags are the state!

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by notyourday on Saturday December 14, 2019 @08:35AM (#21789433)

> Using a CDN that will let you “tag” resources and conditionally provide access based on whether HTTP headers match those tags, you issue tokens to clients and add or remove tags to give and revoke access.

The tokens are the resource.

Your auth is what tags the tokens. Your auth is the only entity that is able to compute the tags that would match the criteria of the tokens to invalidate them.

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by notyourday on Friday December 13, 2019 @11:32PM (#21787829)

Correct. I can assert a validity of the token without touching any database. Not only that, but the API does not even need to compute what it is. That's what makes it stateless.

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by jakelazaroff on Friday December 13, 2019 @11:45PM (#21787877)

It’s not stateless, you’re just trading a database for “tags”. This is exactly the same as if you just placed a stateful authentication service that checks a database in front of your API. How do you think the CDN works?

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by kelnos on Saturday December 14, 2019 @02:42AM (#21788337)

I guess the idea is that it's "stateless" in the sense that you don't have to maintain the state yourself, and the CDN will do it for you? I mean... okay, I guess the point of being stateless is that you don't want to deal with the scaling and reliability issues around storing state, so pushing that responsibility onto a third party (whose uptime is required to get to your site anyway) is "stateless" from your perspective.

I certainly wouldn't call that "stateless", but it does fulfill the main reason why you might want to be stateless, that you don't have to maintain any state yourself.

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by jakelazaroff on Saturday December 14, 2019 @11:32AM (#21790311)

Exactly — it's basically the same as writing your own separate authentication service, or using Auth0/Cognito/Firebase.

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by notyourday on Saturday December 14, 2019 @08:35AM (#21789429)

The reason why it is stateless is because there's no state associated with a token that I have to maintain.

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by notyourday on Saturday December 14, 2019 @08:29AM (#21789411)

You do not maintain the tags. You compute the tags and you do not care what so ever if the tag ever matches anything.

[ Parent | on HN ]

Re:Ask HN: What's the current sentiment on JWT for stateless... by jakelazaroff on Saturday December 14, 2019 @10:18AM (#21789858)

It doesn’t matter who maintains them — the tags are still state. It may be stateless from your API’s perspective, but the system as a whole is still stateful.

[ Parent | on HN ]