3 ms·

I’m still not understanding the advantages of JWT over cookies for user facing auth. I do see use cases for JWT for machine-to-machine auth though.

by moltar 7y ago

kyriakos 7y ago
technically you keep some session data on the client which would normally be kept on the server
matthoiland 7y ago
A server can issue a JWT and forget about it. Most cookie auth strategies requires the server to persist the token to confirm validity. Also, a JWT can work across a microservice architecture easily for the same reasons.
- latortuga 7y ago
  The biggest problem with JWT is there is no revocation mechanism which IMHO is a non-starter. Introducing revocation mechanisms generally means introducing central state and now you're back to why not just use a session token? Not to mention the numerous issues JWT has had over the years.
- sam_lowry_ 7y ago
  Finally a meaningful explanation of JWT.
latortuga 7y ago
The correct comparison is JWT vs sessions, not JWT vs cookies. Cookies are a storage mechanism, and you would compare them to localStorage. Assuming you meant JWT vs sessions, yes, there aren't any except that it's super trendy.
shantly 7y ago
They let you answer the question "did some other machine I trust find this entity to be a valid user, having this identity and the rights they assert they have?" without asking that machine directly or storing anything about the user. More or less. Provided the keys haven't leaked, of course. The chief difficulty this introduces is manually invalidating tokens. You end up having to store some data and/or ask some other system questions about users (blacklist-related, in either case) after all, reducing the initial benefit. But distributed sessions will run into similar problems anyway. Basically if your auth lives the same place as all parts of your application the user will ever see, don't bother with it because the benefit is little to none, otherwise, JWT's a solid maybe.

I’m still not understanding the advantages of JWT over cookies for user facing auth. I do see use cases for JWT for machine-to-machine auth though.

by moltar 7y ago

I’m still not understanding the advantages of JWT over cookies for user facing auth. I do see use cases for JWT for machine-to-machine auth though.

kyriakos 7y ago

technically you keep some session data on the client which would normally be kept on the server

matthoiland 7y ago

A server can issue a JWT and forget about it. Most cookie auth strategies requires the server to persist the token to confirm validity. Also, a JWT can work across a microservice architecture easily for the same reasons.

latortuga 7y ago
The biggest problem with JWT is there is no revocation mechanism which IMHO is a non-starter. Introducing revocation mechanisms generally means introducing central state and now you're back to why not just use a session token? Not to mention the numerous issues JWT has had over the years.
sam_lowry_ 7y ago
Finally a meaningful explanation of JWT.

latortuga 7y ago

The correct comparison is JWT vs sessions, not JWT vs cookies. Cookies are a storage mechanism, and you would compare them to localStorage. Assuming you meant JWT vs sessions, yes, there aren't any except that it's super trendy.

shantly 7y ago

They let you answer the question "did some other machine I trust find this entity to be a valid user, having this identity and the rights they assert they have?" without asking that machine directly or storing anything about the user. More or less. Provided the keys haven't leaked, of course. The chief difficulty this introduces is manually invalidating tokens. You end up having to store some data and/or ask some other system questions about users (blacklist-related, in either case) after all, reducing the initial benefit. But distributed sessions will run into similar problems anyway. Basically if your auth lives the same place as all parts of your application the user will ever see, don't bother with it because the benefit is little to none, otherwise, JWT's a solid maybe.