JWT should not be your default for sessions

Re:JWT should not be your default for sessions by spookthesunset on Wednesday May 12, 2021 @10:50PM (#27137902)

Because a lot of people see security in terms of black and white instead of a lot of shades of gray. Not everything requiring authentication is your bank account. HN, for example, could have even a 10 minute window and be okay.

Not having to block all your request waiting for the auth backend can improve your latency by a non-trivial amount. It also can make your auth server much less complex.

JWT is awesome. People just think it is "all or nothing" and implement it wrong.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by ryan-allen on Monday May 17, 2021 @03:50AM (#27180988)

> JWT is awesome.

That's generally my thought, too. In my career the authentication sophistication was always a trade off (effort vs security) based on how paranoid the org felt about certain things.

Having worked on PHP/Rails/.NET Webforms/Node.js apis/C# webapis the session management techniques are all very different.

Having run high traffic websites also, the ability to offload logged-in sessions into JWT was really, really nice. Not having to prune auto-generated sessions from disk of PHP applications is a nice thing to not worry about.

[ Parent | on HN ]