Re:Paseto is everything you love about JWT without any of th...
by Nursie on Monday October 03, 2022 @02:49AM
(#33064257)
I think, having given it a read in the past, the idea is a little like TLS 1.3 is to previous versions of TLS - it removes the choice to implement badly.
Yes, I agree, accepting any old signature algorithm is a trivial bug in the application that uses JWTs, but I guess it's something that's happened enough to be an issue.
I think the real question is - what major components/projects support these as well as/instead of JWTs? Is it reaching any sort of critical mass, or is it a well-designed curiosity?
Yes, I agree, accepting any old signature algorithm is a trivial bug in the application that uses JWTs, but I guess it's something that's happened enough to be an issue.
I think the real question is - what major components/projects support these as well as/instead of JWTs? Is it reaching any sort of critical mass, or is it a well-designed curiosity?