News for hackers. Stuff that matters.

A comment on JWT should not be your default for sessions. Parent comment

Re:JWT should not be your default for sessions by whateveracct on Wednesday May 12, 2021 @09:56PM (#27137591)
For users, I like to have a secret key per user and put something signed with this key in a cookie to represent the session. Then "log out everywhere" is as simple as regenerating their secret key.

No need to have to persist state for each session, which is nice.

[ Parent | on HN ]
Re:JWT should not be your default for sessions by barrkel on Wednesday May 12, 2021 @10:21PM (#27137721)
Where is the secret key stored? This may not be per session but it is per user, which for most apps is almost the same thing.
[ Parent | on HN ]
Re:JWT should not be your default for sessions by whateveracct on Wednesday May 12, 2021 @11:10PM (#27138006)
It's per-user. Just a column with all their other stuff.

Sessions:Users are Many:1 typically so that's not as simple

[ Parent | on HN ]
Re:JWT should not be your default for sessions by tatersolid on Thursday May 13, 2021 @11:46PM (#27150479)
So you have todo a DB call to get this key on every page load or API request?

You’re back to square one. Just use an opaque random session ID

[ Parent | on HN ]
Re:JWT should not be your default for sessions by whateveracct on Friday May 14, 2021 @01:51AM (#27151170)
I do those anyways - from my user table. But I don't have some extra table of sessions that is append-only (modulo expiration). Cuts out an entire system.
[ Parent | on HN ]