anon1252

> JWTs are a silver bullet, but it's nicer than rolling your own signing scheme.

you can use HMAC to sign session cookies as well, the issue isn't about signing.

> Traversing a list of 100,000 users/sessions in a db to pull up the session is a different beast compared to traversing an in memory list of 10-100 revoked JTIs in redis. It is a lot less data to store and optimize (the full session vs. a small list of revoked JTIs)

I don't see why one can't use redis to persist sessions at first place and why your list of revoked token would be limited to 100.

> Ok, yes, session is a concept. Session state can be stored in its entirety or split between an ID and body.

the storage of session has absolutely nothing to do with the session. I'm not sure why you keep talking about Cookies it has nothing to do with the problem. JWT can be persisted with cookies as well.

Yes it does mean something. a session is something that is identified by an ID on the client and is persisted on the server with the corresponding ID. It's a concept. It doesn't have to be stored in a cookie. A session can be represented by a token and stored in any client side storage.

> Cookies are special headers added to HTTP requests to store state.

The topic is more about session VS JWT, not cookies vs whatever local storage is used in place of cookies.

> and expiring it when you log-out?

and how would you do that if the user doesn't actively log out of a service?

The idea of JWT is basically you give your user a "token" that can be used against many "services" while servers don't have to persist the state of that token, just be able to read the encrypted token, and trust the information in the token. The obvious issue is the server cannot easily revoke that token without blacklisting it, therefore persisting that token somewhere on a blacklist on the server. If you are going to make a lookup for a token in a blacklist you might as well look up for a session ID to being with.

I would absolutely subscribe to a email service with a 5/10/15 dollars one time payment.

> Shouldn't employees have the right to collectively strike to get better conditions at work? There's a lot more at stake here than "drama for the company".

Doesn't the employer have the right to fire them for any reason in any "at will job"?

> there's no real process in place for situations of misconduct in the office.

There shouldn't be a "process" set by Google when it comes to sexual harassment, employees should be able to sue, that's the process,sexual harassment is a crime, they can't sue because Google force them into arbitration, which should be illegal for an employer to do that to an employee IMHO. this is a denial of justice.

> What would make you think there's a lack of outrage related to the US and Iraq + Afghanistan?

Where is the outrage right now? where is the outrage over the slaughter of children in Yemen by the Saudis using US weapons? I don't see any here or in the US mainstream media. if you are an american, your tax dollars helped created these weapons.

> There are 40 enemy combatants held at Guantanamo. They have public legal representation and visitation rights.

They are being held there without a trial. They have not been tried before being sent there.

> Please enlighten me as to how that compares to what the US is currently doing with Guantanamo.

Because the basic human rights of these prisoners are not respected. Some have been jailed there for more than 10 years without any form of trial or justice. If they committed a crime they belong to a US prison, not some shady oversea jail ran by US. And let's not get started on how they were brought there. US just delegated torture to people like Egyptian or Turkish authorities. Black sites are not a legend.

While it doesn't excuse what China is doing, let's not pretend that there is nothing wrong with the situation in Guantanamo.