3 ms·
Tangential question: what is the best practice for handling authentication on a SPA? I have seen JWT being heavily criticized on HN and elsewhere. What is the a
by smnrchrds 9y ago
Tangential question: what is the best practice for handling authentication on a SPA? I have seen JWT being heavily criticized on HN and elsewhere. What is the alternative that still maintains the separation between front- and back-end?
- navd 9y agoLike anything else it depends. JWTs are still great. Just don’t treat it like a classical session and dump important information in it. You could also use session like you always have if the SPA is being served by the same server.
- snuxoll 9y agoJWT is at the heart of OpenID connect, I agree they’re still perfectly reasonable. The big issue I have with JWT is they are hard to invalidate for security reasons, but if you lower the validity and refresh the token more often you can mitigate (not eliminate) the risk.
- san_at_weblegit 9y agoTangential answer: It would vary based on sensitivity of your application. JWT is not a bad option if we do not have a requirement of absolute session termination and if implementation does not have any vulnerability. People also use cookie shared on the root domain(backend and front end can be served by different sub domain. Also you can use custom headers since cookie is just another type of header managed by browser itself. The additional work would be around managing the additional header on back end. People generally open doors for CSRF attack by separating front end and backend like this. Good thing is that there are simple solutions to mitigate that risk too.