News for hackers. Stuff that matters.
Re:Critical Vulnerabilities in JSON Web Token Libraries by ultrafez on Wednesday April 01, 2015 @05:18AM (#9302510)
If you change your algorithm, your old tokens are still usable because you know which algorithm was used to create them.
Re:Critical Vulnerabilities in JSON Web Token Libraries by marcioaguiar on Wednesday April 01, 2015 @08:41AM (#9303106)
It would not be possible to establish a period to migrate all tokens? This "if you change in a possible feature" is not a good argument when modeling something, in my opinion. That's how AbstractFactoryStrategies are made.
Re:Critical Vulnerabilities in JSON Web Token Libraries by bronson on Wednesday April 01, 2015 @01:52PM (#9305456)
That sounds like a very niche case, probably not worth solving. That said, the JWT lib could allow you to specify one or more fallback algorithms in case the default one fails to validate.

If you're switching off an algorithm, you're probably doing it because it's been broken. And, if it's broken, you won't use it anyway.