4 ms·
Well the good news is I've written about this exact subject at length! I have seen JWT implementations at five or six different companies now, tokens have neve
by kevinburke 8y ago
Well the good news is I've written about this exact subject at length!
I have seen JWT implementations at five or six different companies now, tokens have never been used for more than one use case. For each specific use case you'd actually want to use it with there is a better solution that doesn't involve JWT, like secretbox or HMAC-SHA256.
https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/ https://kev.inburke.com/kevin/things-to-use-instead-of-jwt/
- CiPHPerCoder 8y agoYou might be happy to see the PASETO spec, which (for v2) uses XChaCha20-Poly1305 for encryption, Ed25519 for signatures, separates the two logically, and doesn't allow for runtime ciphersuite negotiation. (v1 achieves a similar result with AES-CTR+HMAC-SHA384-EtM and RSASSA-PSS.) https://github.com/paragonie/paseto/tree/master/docs/01-Protocol-Versions https://github.com/paragonie/paseto/tree/master/docs/01-Prot... It's similar to the advice given above, but also caters to that itch that some project managers have to only implement industry standards (which PASETO is slowly becoming).
- sierdolij 8y agoPASETO seems to signal quality: libsodium, simple spec, platform-agnostic in the freak'n name. I keep seeing the horrors and defects of JOSE/JWT, but then it keeps getting promoted. Maybe this is only an anecdotal example, but overly-enthusiastic populism in tech, IME, seems to have track-record of being a road to pain and sometimes ruin. https://paseto.io https://paseto.io XChaCha20-Poly1305 construction in libsodium https://download.libsodium.org/doc/secret-key_cryptography/aead/chacha20-poly1305/xchacha20-poly1305_construction https://download.libsodium.org/doc/secret-key_cryptography/a...