6 ms·
No, using JWT will not make your application more secure. Continue using cookies. Don't buy into the JWT hype. You'll probably want to add a CSRF token. You're
by TheAceOfHearts 9y ago
No, using JWT will not make your application more secure. Continue using cookies. Don't buy into the JWT hype. You'll probably want to add a CSRF token.
You're correct in stating that implementing an OAuth provider is unnecessary.
I suggest reading the OWASP security guides. Start with Session Management Cheat Sheet [0], and after that Cross-Site Request Forgery (CSRF) [1].
Don't fear the cookies, all their gotchas are well documented and understood. There's lots of valid use-cases for stuff like JWT and OAuth, but I wouldn't bother with it at all until you're more comfortable with digging into the AuthN/AuthZ minefield. I'd consider understanding session management with cookies a precursor to trying to do anything fancier.
[0] https://www.owasp.org/index.php/Session_Management_Cheat_Sheet https://www.owasp.org/index.php/Session_Management_Cheat_She...
[1] https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(...
- welder 9y ago> understanding session management with cookies a precursor to [JWT] +1
- teach 9y agoIt's one of the social norms on HackerNews that "low-value" comments like "Love it!" and "+1" are discouraged. Although such comments are polite to the poster, they add nothing but noise for all the other readers of the thread. Instead, it seems to be preferred that you simply upvote the post without replying.
- DDerTyp 9y ago+1 agree
- welder 9y agoThat one part was very important and needed to be called out from the rest of his comment.
- teach 9y agoI don't disagree with you. I'm just explaining why you were downvoted/flagged. HNers are going to downvote anything that looks like a "+1" so maybe try rewording your comment in the future. Instead of just a pulled-out quote and a thumbs-up, quote and then add a couple of sentences explaining why that part was very important.
- deleted 9y ago[deleted]
- dwaite 9y agoAgreed, the essential piece is finding a reference to understand the security issues. Technology choices don't replace the need to understand that (although some choices may affect the urgency through unsafe defaults).
- gizzlon 9y ago> "No, using JWT will not make your application more secure. Continue using cookies" Cookies vs JWT makes no sense. You can put the JWT in a cookie if you want to.. apples and oranges.
- wraithm112 9y agoAbsolutely. Though, when people say cookies vs JWT, what they mean is: Cookies: a simple session ID, a random number, stored in a cookie. JWT: a JSON object stored in local storage that specifies authorization of some user that is authenticated by public key cryptography. JWTs can be configured in many ways, but this is what people usually mean because they want their sessions to be "stateless." Way way more often than not, the "cookie" solution is better because it's far simpler. JWTs come with a tremendous amount of complexity with few benefits.
- zip1234 9y agoMy big issue with JWTs: securing images. With cookies, a browser attaches the cookie on the image request. With JWT, a browser does not send it with the request. Cookies are far easier in this case.
- Edd314159 9y agoJWTs are small enough that they can fit in a URL most of the time. So there's always that option.
- TheAceOfHearts 9y agoI believe it is generally considered unwise to attach your authentication token to the URL, as it's highly likely to end up in a bunch of access logs.
- imauld 9y agoIf the token is only good for one use or for a short period of time (minutes not hours) it's probably fine. I've used them in URL's for invite links. One time use that expire after a short amount of time. Probably not perfect for high security applications like banks or health care but for most applications it's fine.