JWT should not be your default for sessions

Re:JWT should not be your default for sessions by quickthrower2 on Wednesday May 12, 2021 @11:40PM (#27138129)

Could make you less secure if the token was leaked somehow (another vuln for example a cross origin type of thing)

You notice odd behaviour so you log out to stop it but the attacker isn’t logged out.

Also with this setup log out of all devices is not possible! Again something you’d be keen to do if seemingly attacked.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by porker on Thursday May 13, 2021 @02:43AM (#27139157)

I've never got my head round how log out of all devices works. It has to have a central store of all sessions?

[ Parent | on HN ]

Re:JWT should not be your default for sessions by lbriner on Thursday May 13, 2021 @03:31AM (#27139388)

It depends on what auth you are using.

In OpenID Connect, there are back channels that talk to each other so that all devices know you have logged out.

If you are using traditional auth then yes, you would need to track session state against the user so that when they access from a particular device, you could check whether they have already logged out.

Some more complex apps use a background thread to check auth status with the server.

[ Parent | on HN ]

Re:JWT should not be your default for sessions by porker on Thursday May 13, 2021 @08:26AM (#27141306)

Thanks for the insight. As Google has this feature I've wondered how they get it to scale up.

[ Parent | on HN ]