Re:Paseto is everything you love about JWT without any of th...
by Nursie on Monday October 03, 2022 @02:49AM
(#33064257)
I think, having given it a read in the past, the idea is a little like TLS 1.3 is to previous versions of TLS - it removes the choice to implement badly.
Yes, I agree, accepting any old signature algorithm is a trivial bug in the application that uses JWTs, but I guess it's something that's happened enough to be an issue.
I think the real question is - what major components/projects support these as well as/instead of JWTs? Is it reaching any sort of critical mass, or is it a well-designed curiosity?
Re:Paseto is everything you love about JWT without any of th...
by ricardobeat on Monday October 03, 2022 @05:03AM
(#33065049)
This is a good start (reachable from the top link in the home page): https://paragonie.com/blog/2018/03/paseto-platform-agnostic-...
Re:Paseto is everything you love about JWT without any of th...
by aPoCoMiLogin on Monday October 03, 2022 @03:00AM
(#33064336)
here's the spec and comparison: https://github.com/paseto-standard/paseto-spec
> Paseto is everything you love about JOSE (JWT, JWE, JWS) without any of the many design deficits that plague the JOSE standards.
Needs to be substantiated. Where's the comparison? There's only a link to a website and presentation talking about the downsides of JOSE, but the only one i see for JWT is poor implementations failing when the algorithm supplied client-side is invalid. That's a trivial bug and hopefully long since fixed. Is that it?