4 ms·

Why not to use JWT in 3 Minutes: http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions-part-2-why-your-solution-doesnt-work/ http://cryto.net/~

Why not to use JWT in 3 Minutes: http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions-part-2-why-your-solution-doesnt-work/ http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-fo...

pat2man 7y ago
That only describes why you shouldn't use them for sessions, not why you should not use them at all.
- thinkloop 7y ago
  What is there besides sessions?
  - grenoire 7y ago
    API access?
    - joepie91_ 7y ago
      For API access, there's no point using JWTs either. In the vast majority of cases, a randomly-generated API key is sufficient and JWT would be unnecessary complexity (you're using TLS, right...?) and in the odd high-security usecase where the key still must not ever be sent to the server, you can use eg. client certificates. And if for some reason you have a weird freak edgecase where you really do need a cryptographically signed stateless token... JWT is unsafe[1] and you want PASETO[2] instead. [1] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba... [2] https://paseto.io/ https://paseto.io/ Edit: To be clear, with "API" I'm assuming you mean "third-party API", in the original sense of the word. If you just mean "a bunch of endpoints for my SPA", then you should use none of these things, and just use sessions. It's not really an "API" in the "API key" sense.
- staticassertion 7y ago
  The article addresses the singular valid use case at the bottom.
NicoJuicy 7y ago
Off-topic Joepie91 once did a small nodejs project for me, that's why I recognized your link. I'm kinda worried as "not an acquaintance" about his post about depression and that he didn't post anything since 2016. Anyone know what happened?
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- thegeekpirate 7y ago
  There's something funky going on with HNs cache, so hopefully this won't be my third visible reply. His GitHub still seems to be active (https://github.com/joepie91 https://github.com/joepie91).
- arianvanp 7y ago
  He's still rather active in the NixOS community. I met him last year. I think he just stopped blogging, that's it.
- joepie91_ 7y ago
  Hi, no worries, I'm still alive :) I just haven't updated my blog for quite some time, due to a combination of circumstances. I'll probably start blogging again at some point in the near future.
  - NicoJuicy 7y ago
    Nice answer, time goes fast ;)
  - masonic 7y ago
    "Reports of my death have been exaggerated." - Churchill
staticassertion 7y ago
What should I use instead? JWT is so damn easy to set up.
andy_ppp 7y ago
So some of those things are true, but you can definitely and almost certainly should expire tokens (and reissue before expiry new tokens) after a short time window, which alleviates some of the security concerns mentioned. Some useful parts of JWTs is they can contain information that can act as a cache so that you don't have to go to the server to show certain parts of your UI or things like names and so on. It's worth evaluating them for your use case rather than assuming they are 100% bad because of the reasons outlined in the article.
- joepie91_ 7y ago
  > So some of those things are true, but you can definitely and almost certainly should expire tokens (and reissue before expiry new tokens) after a short time window, which alleviates some of the security concerns mentioned. That doesn't really help, because now you need some other sort of token to authenticate the user for handing out a new short-lived token, and that new token now has the same inability-to-revoke problem. You've just moved the problem. > Some useful parts of JWTs is they can contain information that can act as a cache so that you don't have to go to the server to show certain parts of your UI or things like names and so on. You don't need a JWT for this. You can just store that in localStorage directly. JWT is not a storage mechanism, it's more of an encoding format.
  - andy_ppp 7y ago
    > That doesn't really help, because now you need some other sort of token to authenticate the user for handing out a new short-lived token, and that new token now has the same inability-to-revoke problem. You've just moved the problem. No you don't, as stated you can refresh your token before it expires. > You don't need a JWT for this. You can just store that in localStorage directly. JWT is not a storage mechanism, it's more of an encoding format. I think you can validate the authenticity of your JWT without having to go to a database. This is much more secure than local storage or even a plain old cookie. JWT provides a useful set of features and just because in your opinion it isn't useful plenty of people disagree with your points.

pat2man 7y ago

That only describes why you shouldn't use them for sessions, not why you should not use them at all.

thinkloop 7y ago
What is there besides sessions?
- grenoire 7y ago
  API access?
  - joepie91_ 7y ago
    For API access, there's no point using JWTs either. In the vast majority of cases, a randomly-generated API key is sufficient and JWT would be unnecessary complexity (you're using TLS, right...?) and in the odd high-security usecase where the key still must not ever be sent to the server, you can use eg. client certificates. And if for some reason you have a weird freak edgecase where you really do need a cryptographically signed stateless token... JWT is unsafe[1] and you want PASETO[2] instead. [1] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba... [2] https://paseto.io/ https://paseto.io/ Edit: To be clear, with "API" I'm assuming you mean "third-party API", in the original sense of the word. If you just mean "a bunch of endpoints for my SPA", then you should use none of these things, and just use sessions. It's not really an "API" in the "API key" sense.
staticassertion 7y ago
The article addresses the singular valid use case at the bottom.

NicoJuicy 7y ago

Off-topic Joepie91 once did a small nodejs project for me, that's why I recognized your link. I'm kinda worried as "not an acquaintance" about his post about depression and that he didn't post anything since 2016. Anyone know what happened?

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
thegeekpirate 7y ago
There's something funky going on with HNs cache, so hopefully this won't be my third visible reply. His GitHub still seems to be active (https://github.com/joepie91 https://github.com/joepie91).
arianvanp 7y ago
He's still rather active in the NixOS community. I met him last year. I think he just stopped blogging, that's it.
joepie91_ 7y ago
Hi, no worries, I'm still alive :) I just haven't updated my blog for quite some time, due to a combination of circumstances. I'll probably start blogging again at some point in the near future.
- NicoJuicy 7y ago
  Nice answer, time goes fast ;)
- masonic 7y ago
  "Reports of my death have been exaggerated." - Churchill

staticassertion 7y ago

What should I use instead? JWT is so damn easy to set up.

andy_ppp 7y ago

So some of those things are true, but you can definitely and almost certainly should expire tokens (and reissue before expiry new tokens) after a short time window, which alleviates some of the security concerns mentioned. Some useful parts of JWTs is they can contain information that can act as a cache so that you don't have to go to the server to show certain parts of your UI or things like names and so on. It's worth evaluating them for your use case rather than assuming they are 100% bad because of the reasons outlined in the article.

joepie91_ 7y ago
> So some of those things are true, but you can definitely and almost certainly should expire tokens (and reissue before expiry new tokens) after a short time window, which alleviates some of the security concerns mentioned. That doesn't really help, because now you need some other sort of token to authenticate the user for handing out a new short-lived token, and that new token now has the same inability-to-revoke problem. You've just moved the problem. > Some useful parts of JWTs is they can contain information that can act as a cache so that you don't have to go to the server to show certain parts of your UI or things like names and so on. You don't need a JWT for this. You can just store that in localStorage directly. JWT is not a storage mechanism, it's more of an encoding format.
- andy_ppp 7y ago
  > That doesn't really help, because now you need some other sort of token to authenticate the user for handing out a new short-lived token, and that new token now has the same inability-to-revoke problem. You've just moved the problem. No you don't, as stated you can refresh your token before it expires. > You don't need a JWT for this. You can just store that in localStorage directly. JWT is not a storage mechanism, it's more of an encoding format. I think you can validate the authenticity of your JWT without having to go to a database. This is much more secure than local storage or even a plain old cookie. JWT provides a useful set of features and just because in your opinion it isn't useful plenty of people disagree with your points.