3 ms·

I think one of the issues is a very practical one. When everything is called JWT, it's hard for users to figure out whether it's a secure or insecure implementa

by treve 9y ago

I think one of the issues is a very practical one. When everything is called JWT, it's hard for users to figure out whether it's a secure or insecure implementation. It's completely possible to do secure things with JWT, especially if you control every producer and consumer, but it's not guaranteed.

jopsen 9y ago
It's completely possible to do insecure things with PAST. There is always going to be someone who hardcodes the root password into a public GitHub repo. The problem with JWT is IMO largely that things became too easy, so people coded without thinking. I'm not sure that's easy to prevent. I don't blame the JWT spec for mistakes that are so obvious.