Should I Use jwts For Authentication Tokens?

Re:Should I Use jwts For Authentication Tokens? by EthanHeilman on Monday May 27, 2024 @01:09PM (#40492645)

The first case sounds more like a case for OAuth which doesn't have to use JWTs or digital signatures.

> I don't really want Google or Apple or whoever has, for idiosyncratic reasons, possession of a private key, to sign every request I make to Google Calendar, because they will inevitably revoke it sooner for obnoxious business reasons than any good security reason.

Can you provide more context on this? I would assume asymmetric signing keys are less likely to be revoked than say an HMAC key since an HMAC key must be securely stored at both the client and server whereas you can just put a asymmetric signing key in an HSM at the client and be done with it.

[ Parent | on HN ]

Re:Should I Use jwts For Authentication Tokens? by radicalbyte on Monday May 27, 2024 @02:43PM (#40493402)

Which we have in modern computers and mobiles (the EU identity wallet concept is built around them).

[ Parent | on HN ]

Re:Should I Use jwts For Authentication Tokens? by EthanHeilman on Monday May 27, 2024 @04:33PM (#40494411)

I thought the EU wallet was using JWTs that attest to public key. You don't use them as bearer tokens, you use them as certificates and then do verifiable credential presentation via proof of possession and SD-JWTs.

[ Parent | on HN ]