Should I Use jwts For Authentication Tokens?

Re:Should I Use jwts For Authentication Tokens? by kayo_20211030 on Tuesday May 28, 2024 @08:24AM (#40500019)

JWT's really can span this middle ground. They're helpful in answering the who-are-you question without resorting to elaborate db work. Even middle-ground monoliths are often deployed across more than one independently operating web server (say, JVM processes) and JWT's ensure that each server answers the who-are-you question with the same answer - the code is the same, and although the process space is different on each web server, the answer is the same. So chained requests, with API.REQ.1 to Server 1 and API.REQ.2 to Server 2 will actually work. Maybe session mechanics will work, but what if you don't actually have a session and just a bunch of API requests?

[ Parent | on HN ]

Re:Should I Use jwts For Authentication Tokens? by andrewmcwatters on Tuesday May 28, 2024 @09:32AM (#40500589)

Querying a database for a session id isn’t elaborate work. It’s also trivial because as TFA mentioned, literally every major web framework ecosystem with has a solution for this.

God, how hard is SELECT * WHERE …, seriously.

You need to share a session across websites? Wow! Connect to the database holding the sessions.

Boring.

[ Parent | on HN ]

Re:Should I Use jwts For Authentication Tokens? by jupp0r on Tuesday May 28, 2024 @11:16AM (#40501527)

Ever heard of speed of light? If you really think that "just connect to the same db" was an easy solution to the problem you describe in the general sense then you haven't done so in a moderately complex system yet. It can be a good solution for a very limited set of circumstances, but that's about it.

[ Parent | on HN ]

Re:Should I Use jwts For Authentication Tokens? by andrewmcwatters on Tuesday May 28, 2024 @11:20AM (#40501590)

It’s bullshit. A majority of high volume systems can do this just fine. This is just engineering wank.

Standard solution is query a session table on from a single location, and once you actually start to need to trim request time, it’s not even the first place you look.

[ Parent | on HN ]

Re:Should I Use jwts For Authentication Tokens? by jupp0r on Tuesday May 28, 2024 @03:41PM (#40504740)

Assumptions you are making:

* everything is located physically close together (good luck reading from a DB table in Singapore from a service in Europe for every request)

* you have few enough client services that want to do this that the number of db connections does not become a problem (this is 100 by default for Postgres, you might need to tune this or deploy proxies, etc)

* high availability is already taken care of (you don't want that one DB server to bring down everything in case of a failure)

[ Parent | on HN ]

Re:Should I Use jwts For Authentication Tokens? by leshenka on Tuesday May 28, 2024 @07:14PM (#40506586)

several comments up this branch we were talking about middle ground, remember

[ Parent | on HN ]

Re:Should I Use jwts For Authentication Tokens? by jupp0r on Tuesday May 28, 2024 @10:46PM (#40507905)

Yes. It's super common for SaaS companies that are <1% the size of Google to have infrastructure in multiple regions.

[ Parent | on HN ]