4 ms·
One advantage I think not mentioned by some of the linked articles is that the JWT's claims are readable on the client. It's a pretty good plus, for me: no add
by kierenj 10y ago
One advantage I think not mentioned by some of the linked articles is that the JWT's claims are readable on the client.
It's a pretty good plus, for me: no additional round-trips to the server to grab key user details, which can be put into claims, or check access levels (via roles, permissions, or other types of claim).
This doesn't discount the disadvantages, of course.. I think as with everything it's a case of the right tool for the job. "Depends on the use case".
- arethuza 10y agoOut of interest, do you check the authenticity and integrity of the JWT on the client side?
- kierenj 10y agoWe provide an endpoint to check validity with the server, but haven't used it too often. Anything "reasonably sensitive" (or more) doesn't depend on anything like this client-side security. But, if you're just hiding an additional Delete button on a page based on claims, this comes in handy. (Edit: in one case, we've used asymmetric keys, i.e. public key so everyone can check integrity. This was a very different use-case to most web apps, though. Overall I'd say if you're carefully checking integrity of something in client-side JS to do something, I think that's probably the wrong approach)
- Freak_NL 10y agoThat's exactly what is useful for. Of course access to a resource is determined server-side; JWT simply allows you to adjust the UI to the permissions the user has without any additional calls. If the user changes the JWT he has client-side, he will just get a broken delete button (the server will reject a JWT that has been tampered with).
- deleted 10y ago[deleted]
- mattmanser 10y agoYou've already been to the server once, if you terri-bad app design requires you to go twice that's more your problem than a "feature" of a broken session system.
- kierenj 10y agoFine, then - to rephrase, it conveniently combines claims with an assertion that the user has been authenticated and authorised. You can do it in other ways too, but it's convenient and a designed part of the make-up of JWT.