Re:# of days since the last alg=none JWT vulnerability
by gavinray on Tuesday September 01, 2020 @06:20PM
(#24347802)
Hey, I can't deny that was me 5 years ago. I was totally putting emails and other personal info into JWT's because "Hey, it's encrypted".
Live and learn haha
But yeah, definitely some lack of awareness around how JWT's work + best practices.
I think that Auth-as-a-Service platforms and the "npm install" culture aren't helping this at all.
In recent years from conversations with other devs, it seems like many of them have never written an auth system themselves + couldn't do it if you asked. Coming from an era where rolling your own token-auth setup, or on larger projects even custom OAuth providers, this is both a bit mindblowing and kind of scary.
Live and learn haha
But yeah, definitely some lack of awareness around how JWT's work + best practices.
I think that Auth-as-a-Service platforms and the "npm install" culture aren't helping this at all.
In recent years from conversations with other devs, it seems like many of them have never written an auth system themselves + couldn't do it if you asked. Coming from an era where rolling your own token-auth setup, or on larger projects even custom OAuth providers, this is both a bit mindblowing and kind of scary.