News for hackers. Stuff that matters.

A comment on Learnings from 5 years of tech startup code audits. Parent comment

Re:Learnings from 5 years of tech startup code audits by ryanbrunner on Thursday May 26, 2022 @09:38AM (#31518194)
It's nuts to me that so many companies have moved off cookies for web app auth state. They're simple, they're well supported, they require very little work on the browser side, and the abstractions around them on the server side are basically bulletproof at this point.

I see all this talk about authentication, and it's just literally never been a problem or concern for my company.

[ Parent | on HN ]
Re:Learnings from 5 years of tech startup code audits by treis on Thursday May 26, 2022 @10:15AM (#31518585)
Aren't JWTs just fancy cookies?
[ Parent | on HN ]
Re:Learnings from 5 years of tech startup code audits by freeqaz on Thursday May 26, 2022 @04:10PM (#31522810)
JWTs are frequently stored in LocalStorage which means that any XSS is able to leak the JWT.

Cookies, on the other hand, can be configured to be HTTP-Only and inaccessible to JavaScript on the page. That prevents somebody with XSS from leaking the value without a second server-side vulnerability or weakness.

In addition, JWTs are impossible to revoke without revoking _all_ sessions. This is the biggest weakness, imo, and the reason that they shouldn't be used client-side.

I'm a huge fan of the approach the Ory is taking with Oathkeeper and Kratos: https://www.ory.sh/docs/kratos/guides/zero-trust-iap-proxy-i...

[ Parent | on HN ]
Re:Learnings from 5 years of tech startup code audits by nijave on Friday May 27, 2022 @12:03AM (#31525913)
Can't you revoke them the same way you revoke any other auth token and put the token ID in a database somewhere?
[ Parent | on HN ]
Re:Learnings from 5 years of tech startup code audits by waplot on Friday May 27, 2022 @12:30AM (#31526018)
it won't be stateless then, and you might as well just use traditional sessions then
[ Parent | on HN ]
Re:Learnings from 5 years of tech startup code audits by ryanbrunner on Thursday May 26, 2022 @06:47PM (#31524204)
Sure, but browsers have done a lot of work to make cookies far more convenient (they're automatically sent with requests, you have browser APIs to work with them), and secure (Secure, HttpOnly, SameSite, etc.)
[ Parent | on HN ]
Re:Learnings from 5 years of tech startup code audits by nijave on Thursday May 26, 2022 @11:56PM (#31525885)
Cookies are a storage and transport mechanism and JWTs are signed JSON blobs. You could put a JWT inside a cookie.
[ Parent | on HN ]