5 ms·

JWTs aren't just bad because they embody poor cryptographic engineering, but they are also bad because stateless authentication in itself is poor security engin

JWTs aren't just bad because they embody poor cryptographic engineering, but they are also bad because stateless authentication in itself is poor security engineering for almost every application. > What solution would you choose today for stateless auth tokens? Issue token (=random 256 bit string), verify against cached database. If you believe this to be a significant performance issue, you are very likely wrong.

ravenstine 7y ago
It's kinda funny how some people think that this would be a performance problem, but it's something that computers and programming languages are specifically designed to do really well.
- bpicolo 7y ago
  KV lookups with no dependent data are pretty much infinitely scalable with modern systems.
  - andyroid 7y ago
    It’s not the lookup that is the cost but the network call.
    - bpicolo 7y ago
      That's darn cheap in modern systems, and most are doing a plethora of network calls per request either way. .5% overhead won't matter for a long time.