News for hackers. Stuff that matters.

A comment on Should I Use jwts For Authentication Tokens?. Parent comment

Re:Should I Use jwts For Authentication Tokens? by zaphar on Monday May 27, 2024 @12:44PM (#40492406)
There are some subtleties here that are important to know[0]. Which is why I generally advise people to use the framework provided code for this.

0: Such as use a secure hash like sha256 or blake2 instead of md5.

[ Parent | on HN ]
Re:Should I Use jwts For Authentication Tokens? by angoragoats on Monday May 27, 2024 @12:46PM (#40492425)
Yes, though I would recommend something that is resistant to timing attacks such as bcrypt. And this was why I mentioned frameworks in my last sentence. My intention wasn’t to give a comprehensive soup to nuts guide for what to do; instead i was giving a high level overview.
[ Parent | on HN ]