Leveraging the Encrypted Token Pattern

Re:Leveraging the Encrypted Token Pattern by chatmasta on Monday December 01, 2014 @02:36PM (#8683160)

Maybe I missed something, but I was surprised there was no mention of JSON Web Tokens (JWT). See [0] (overview) and [1] (example usage).

[0] http://self-issued.info/docs/draft-ietf-oauth-json-web-token...

[1] https://github.com/mattupstate/flask-jwt

[ Parent | on HN ]

Re:Leveraging the Encrypted Token Pattern by cjlarose on Monday December 01, 2014 @02:49PM (#8683265)

At the time of writing (September 2013), the JWT spec would have been only on it's 12th draft--it's had 19 follow-up drafts since then. It's possible that the author didn't know about them at all.

[ Parent | on HN ]

Re:Leveraging the Encrypted Token Pattern by paulmooney on Tuesday December 02, 2014 @06:35AM (#8686627)

As you say, the JWT spec was not as mature at the time of writing.

[ Parent | on HN ]

Re:Leveraging the Encrypted Token Pattern by chatmasta on Tuesday December 02, 2014 @12:26PM (#8688328)

(Assuming you're the author -- who knows though.) Now that the JWT spec is mature and there are some nice implementations of it, do you think it's a good option for token-based authentication?

[ Parent | on HN ]

Re:Leveraging the Encrypted Token Pattern by paulmooney on Friday December 12, 2014 @12:18PM (#8741327)

Yes, I'm the author. Long as the JWT spec implements a strong method of encryption , it's a good option.

[ Parent | on HN ]

Re:Leveraging the Encrypted Token Pattern by paulmooney on Tuesday December 02, 2014 @06:35AM (#8686623)

The JWT was not as mature at the time of writing. In any case, The structure of the token itself is open for extension. The pattern focuses on the manner in which the token is leveraged.

[ Parent | on HN ]