3 ms·
There are other ways to pass claims -- like using bearer tokens in the HTTP header, or using OAuth 2. (All with TLS, of course)
by danesparza 8y ago
There are other ways to pass claims -- like using bearer tokens in the HTTP header, or using OAuth 2. (All with TLS, of course)
- sprt 8y agoYes, JWTs don't bring anything new to the table. In fact, most articles promoting their use don't even explain why you should use them. This is cargo cult programming at its utmost.
- orf 8y agoThere are many ways to do many things. That doesn't make it cargo cult programming. Encoding your claims as a JWT is useful because there are many libraries that work with this, it's a known format (and one that's not tied to any particular transport), and is really good for creating stateless authentication systems using asymmetric keys. If you're interested in the differences between JWTs and something like OAuth (which really are two different things entirely) then you can visit https://google.com https://google.com and type in "JWT vs Oauth2". Answers will appear on your screen.
- schnable 8y agoJWT is just a standard for bearer tokens (including those used by OAuth 2).
- danesparza 8y agoI originally thought so myself. But RFC 7519 (https://tools.ietf.org/html/rfc7519 https://tools.ietf.org/html/rfc7519) is different from RFC 6750 (https://tools.ietf.org/html/rfc6750 https://tools.ietf.org/html/rfc6750) -- and the two don't mention each other's implementation.
- leejo 8y agoRFC 6750 describes the format of Bearer tokens: https://tools.ietf.org/html/rfc6750#section-2.1 https://tools.ietf.org/html/rfc6750#section-2.1 # it happens than JWTs fit the format, so they can be used. The spec is vague enough here that you can stuff almost any string you want into the header, as long as it has sufficient entropy that it is near impossible to brute force. Of course, JWTs introduce their own concerns, as discussed in other comments.