3 ms·

By "JWT" do you mean the the format? (RFC 7519) Or perhaps you meant OpenID Connect? I can think of reasons for you to urge your clients to avoid JWT-the-forma

• lvh 9y ago
  (I work at Latacora and 'tptacek and I have worked on spitballing what that ideal protocol might look like.) Right now the answer is SAML because a) we can make it not a nightmare b) it is the de facto enterprise SSO protcool. To make SAML not a nightmare, we do the tiniest part of SAML that produces valid dsigs that other apps consume. It's not so bad as long as you just get that one basic case right and then NEVER TOUCH IT AGAIN. At some point, it's likely that we figure out what a good alternative would look like and publish that too, but it needs a clear value proposition that outweighs SAML's crushing market penetration. Something like "you can plausibly implement this in a dozen lines in every programming language" and "if you mess it up it stops working". You're probably right about the reasons OIDC isn't it. Maybe we just need a protocol with one more CSRF token parameter!