News for hackers. Stuff that matters.

A comment on # of days since the last alg=none JWT vulnerability. Parent comment

Re:# of days since the last alg=none JWT vulnerability by statictype on Tuesday September 01, 2020 @06:46PM (#24348014)
> The other big mistake I've seen is encoding personal data in the token,

You’re right that this is a big mistake but I also thought this was in fact one of the primary allures of JWT - an attempt (misguided) to make session management stateless and avoid that database roundtrip on the server end?

[ Parent | on HN ]
Re:# of days since the last alg=none JWT vulnerability by jimktrains2 on Tuesday September 01, 2020 @07:02PM (#24348133)
This has been my experience, and the issue of figuring out if a token has been revoked is usually punted on.
[ Parent | on HN ]