News for hackers. Stuff that matters.

A comment on JWT vs. Opaque Tokens. Parent comment

Re:JWT vs. Opaque Tokens by hobofan on Thursday September 29, 2022 @09:19AM (#33020218)
That they've been around for long enough for proper implementations in all major languages to exist, their pitfalls being documented and a lot of devs have some familiarity with it.

With that they are a better choice than most homebrew/framework-specific solutions.

There are some other established (/"standardized") solutions, which might fit your use-case better though, but most of them lag behind JWT in implementations/dev familiarity.

[ Parent | on HN ]
Re:JWT vs. Opaque Tokens by goodpoint on Thursday September 29, 2022 @10:39AM (#33021328)
Spot on. Even better if they used a better serialization protocol than stupid JSON.
[ Parent | on HN ]
Re:JWT vs. Opaque Tokens by fireflash38 on Thursday September 29, 2022 @01:28PM (#33024191)
JSON really is the worst serialization, except for all the others.
[ Parent | on HN ]
Re:JWT vs. Opaque Tokens by Sohcahtoa82 on Thursday September 29, 2022 @03:13PM (#33025630)
What's wrong with JSON?
[ Parent | on HN ]
Re:JWT vs. Opaque Tokens by goodpoint on Friday September 30, 2022 @03:35PM (#33039660)
It requires a complex scanner with a stack to track nested data structures.

Not good for security nor speed in the use-case of a auth token!

[ Parent | on HN ]
Re:JWT vs. Opaque Tokens by Aeolun on Thursday September 29, 2022 @08:28PM (#33029223)
It doesn’t have a native date type. And you cannot have comments.
[ Parent | on HN ]