News for hackers. Stuff that matters.

A comment on Critical Vulnerabilities in JSON Web Token Libraries. Parent comment

Re:Critical Vulnerabilities in JSON Web Token Libraries by sandstrom on Wednesday April 01, 2015 @04:18AM (#9302304)
I agree with you (I do the same).

However, in certain cases it's useful to have stateless sessions (or rather, moving the state to the client, using signed and/or encrypted tokens).

In this case, JWT is used by e.g. OpenID-Connect, to pass data between systems. In some of these use-cases the client is an intermediary, passing along the token.

[ Parent | on HN ]
Re:Critical Vulnerabilities in JSON Web Token Libraries by laumars on Wednesday April 01, 2015 @04:22AM (#9302321)
Like a portable passport rather than a centralised authentication model. That does sound an interesting concept :)
[ Parent | on HN ]
Re:Critical Vulnerabilities in JSON Web Token Libraries by mahmud on Wednesday April 01, 2015 @05:26AM (#9302537)
Passports (travel documents) are increasingly moving to central authentication too. They were prone to trivial forgery before they were chipped and barcoded. And exactly for the same reason.
[ Parent | on HN ]