News for hackers. Stuff that matters.

A comment on JWT should not be your default for sessions. Parent comment

Re:JWT should not be your default for sessions by hermanradtke on Wednesday May 12, 2021 @08:43PM (#27137067)
The issue is not deleting the cookie. The issue is that the JWT can still be used as a valid session unless you have some sort of blocklist. Once you introduce a blocklist, you might as well ditch the JWT and use some opaque token stored in a table.
[ Parent | on HN ]
Re:JWT should not be your default for sessions by remram on Wednesday May 12, 2021 @09:21PM (#27137375)
Is that a problem though? Does your threat model include clients that correctly send logout requests when they're supposed to but don't delete cookies when they're told?
[ Parent | on HN ]
Re:JWT should not be your default for sessions by colinclerk on Wednesday May 12, 2021 @09:44PM (#27137517)
Your application should certainly have some resolution to an account being hacked or a session token being stolen.

No expiry and no denylist means an attacker can cause problems until you patch your code.

[ Parent | on HN ]
Re:JWT should not be your default for sessions by jfgiogktkt on Wednesday May 12, 2021 @10:00PM (#27137615)
You logout on a public computer, the next user undeletes the cookie (which is just a row in a profile SQLite database).
[ Parent | on HN ]
Re:JWT should not be your default for sessions by remram on Thursday May 13, 2021 @03:24PM (#27146231)
Couldn't the previous user have rigged the app to not send the logout request, or way more plausibly installed a keylogger to get your password, which allows them to log in again at will?

I'm not disagreeing with you, it just seems to only cover a very specific type of attack, if someone else can mess with software. And of course if they can't it is unnecessary.

[ Parent | on HN ]
Re:JWT should not be your default for sessions by SigmundA on Wednesday May 12, 2021 @09:48PM (#27137543)
Never trust the client, ever.
[ Parent | on HN ]
Re:JWT should not be your default for sessions by remram on Thursday May 13, 2021 @03:48PM (#27146498)
If that's how you feel, don't trust them to logout when they walk away. Make those sessions short-lived and ask for the password again whenever they do something remotely sensitive.
[ Parent | on HN ]
Re:JWT should not be your default for sessions by SigmundA on Thursday May 13, 2021 @04:11PM (#27146774)
If you trust the client then why sign the JWT?
[ Parent | on HN ]
Re:JWT should not be your default for sessions by remram on Friday May 14, 2021 @02:06PM (#27157613)
The opposite of "never trust the client" is not "always trust the client". Build yourself a model and find out where trust and security are required.
[ Parent | on HN ]
Re:JWT should not be your default for sessions by axiosgunnar on Wednesday May 12, 2021 @08:57PM (#27137205)
the entire article could be summed up with this post tbh
[ Parent | on HN ]