3 ms·

I think this assumes that people are switching from server-backed sessions to JWT. I'd expect instead that most people (and frameworks now-a-days) use signed c

I think this assumes that people are switching from server-backed sessions to JWT. I'd expect instead that most people (and frameworks now-a-days) use signed cookies instead. Switching to JWT just standardizes that format a bit to allow non-web clients (like mobile apps) to use a similar session. I think Armin Ronacher's blog post[0] is a good overview on the benefits of using signed client storage for session state. [0]: http://lucumr.pocoo.org/2013/11/17/my-favorite-database/ http://lucumr.pocoo.org/2013/11/17/my-favorite-database/

CiPHPerCoder 10y ago
JWT is often used as an implementation of signed cookies. Also, don't use signed cookies unless you have a crypto expert on staff.
- spriggan3 10y ago
  > Also, don't use signed cookies unless you have a crypto expert on staff. As opposed to what ? re-implementing cookies from scratch with JWT ? JWT is a dangerous system because it's even harder to get things right. Cookies and their flaws have been documented for decades, no need to be a crypto expert to sign cookies.
  - CiPHPerCoder 10y ago
    > no need to be a crypto expert to sign cookies You literally just said the equivalent of "no need to be a crypto expert to implement cryptographic signatures." Please don't do that without a crypto expert on staff. They'll be able to avoid side channels that non-experts will never even imagine. To wit: http://blog.ircmaxell.com/2014/11/its-all-about-time.html http://blog.ircmaxell.com/2014/11/its-all-about-time.html It's just a bad idea all around.