Re:JWT should not be your default for sessions
by alexjplant on Wednesday May 12, 2021 @09:19PM
(#27137356)
I also seem to recall PHP doing this in the form of PHPSESSID in the query string.
It's a bad idea no matter who's doing it though. It enables accidental session-jacking (unless you turn on annoying countermeasures like invalidating sessions when IPs change and so forth), reduces cacheability, and a whole bunch of other things that come with leaking a secret in the URL. I don't think JWTs are a panacea but they beat the heck out of 2003-era session management.
Re:JWT should not be your default for sessions
by treve on Wednesday May 12, 2021 @09:45PM
(#27137525)
Yeah, I got this comment elsewhere too. I decided to not edit, because I think current standards at least strongly discourage session id's in urls, and this functionality is basically obsolete.
Sessions requiring cookies felt like a reasonable approximation, and I've already had to hedge so many other statements =)
Re:JWT should not be your default for sessions
by IgorPartola on Wednesday May 12, 2021 @10:35PM
(#27137820)
You can also just use Basic auth and get an Authentication header sent with every request. You know, what auth systems should have been using all along.
“Often, sessions and cookies are described as 2 different things, but they’re really not. A session needs a cookie to work.”
This is false. Inital JAVA Servlet specifications supported session id in the URL.