3 ms·
He suggests KISS: you can probably get away with plain old server-side auth, and if you really need client-side tokens, use something simple that just encrypts
by icebraining 8y ago
He suggests KISS: you can probably get away with plain old server-side auth, and if you really need client-side tokens, use something simple that just encrypts and signs them: https://news.ycombinator.com/item?id=13612941#13615634 https://news.ycombinator.com/item?id=13612941#13615634
- Aeolun 8y ago> Something simple that just encrypts and signs them Like JWT? I feel like that argument goes around in circles.
- geezerjay 8y ago> I feel like that argument goes around in circles. I feel that the problem is that some users are talking about stuff they know nothing about, but still feel compelled to be very vocal and opinionated.
- icebraining 8y agotptacek's point is that JWT is not simple at all: https://news.ycombinator.com/item?id=13866983 https://news.ycombinator.com/item?id=13866983 https://news.ycombinator.com/item?id=14292223 https://news.ycombinator.com/item?id=14292223
- ad-hominem 8y agoJWT's are NOT encrypted by default. They are cryptographically signed. That is totally different. If you get somebody's JWT, you can get everything stored in the token as well. If you want it to be encrypted, you have to encrypt the token (presumably following JWE).