Web Authentication Methods Compared

Re:Web Authentication Methods Compared by combatentropy on Wednesday December 23, 2020 @03:31PM (#25521842)

It calls some of these stateless, but don't they all have to run a secondary look-up?

For example, in Basic Authentication, you still have to check the username and password against a database, whether that be a file, a relational database, LDAP, etc. For JWT, to verify the signature you must look up the issuer's pre-shared or public key.

Is it even possible for a request be stateless if it requires authentication?

[ Parent | on HN ]

Re:Web Authentication Methods Compared by Shmebulock on Wednesday December 23, 2020 @03:42PM (#25521972)

I agree the article is confusing wrt state.

Basic Auth is stateless on the client side but not on the server side.

Token auth is stateless on server side; it does not need to store any more public/private key pairs as the number of authenticating users increases. It can just use one. So authenticating users does not affect state

[ Parent | on HN ]

Re:Web Authentication Methods Compared by combatentropy on Wednesday December 23, 2020 @06:19PM (#25523421)

> it does not need to store any more public/private key pairs as the number of authenticating users increases

That's a good point. Thank you

[ Parent | on HN ]