3 ms·

JWT is much simpler architecture than looking up session tokens every request.

eropple 7y ago
Until you need revocation. Which is to say until you need a working authentication system. JWTs solve a nonexistent problem in the 99.9% case but are so very, very bloggable that they've brainwormed the population but good.
- spookthesunset 7y ago
  It’s a trade off dude. You trade off the ability to revoke a token instantly for fewer backend calls. For most parts of your site (99.9%) that trade off is fine. For the parts where it isn’t fine you... call the auth server every request. JWT doesn’t mean you give up anything....
GordonS 7y ago
That's demonstrably not true; it might be more efficient for loaded systems, but it's certainly not simpler. Looking up an ID in a database is much simpler that using JWTs (which involve crypto) and handling revocation. Libraries might hide a lot of the complexity of JWTs behind abstractions, but that doesn't mean it doesn't exist.
- spookthesunset 7y ago
  Oh please... you are seriously going to argue it is less complex call a database or redis than it is to locally validate a token using proven crypto methods that have existed for decades? If you are gonna play the “look under the layers of abstraction to count true complexity” game.... your assertion falls apart in a hurry. Calling a database or redis every http request is a hell of a lot more complex in terms of call stack, configuration, network dependencies and library support than JWT. But it is a stupid way to frame your argument to begin with. Both ways abstract all their doings behind a library. Both probably have almost the same general configuration foot print. And JWT has the benefit that you can still treat it like a session token and validate on every call for parts of your site that need it. Most sites do not need to instantly revoke a token everywhere! The number of detractors around here who don’t understand that last point is pretty sad...
  - GordonS 7y ago
    While I think your response is overly harsh, I could have phrased my argument better. What I'm getting at is that the JWT spec has issues, JWTs are complex to get right, and they have (notorious) encryption footguns. Connecting to a database is a relatively simple affair. For the record, I'm not a JWT "detractor" (if you look elsewhere in this thread you'll find a comment where I used it to good effect).

Until you need revocation. Which is to say until you need a working authentication system. JWTs solve a nonexistent problem in the 99.9% case but are so very, very bloggable that they've brainwormed the population but good.

spookthesunset 7y ago
It’s a trade off dude. You trade off the ability to revoke a token instantly for fewer backend calls. For most parts of your site (99.9%) that trade off is fine. For the parts where it isn’t fine you... call the auth server every request. JWT doesn’t mean you give up anything....

GordonS 7y ago

That's demonstrably not true; it might be more efficient for loaded systems, but it's certainly not simpler. Looking up an ID in a database is much simpler that using JWTs (which involve crypto) and handling revocation. Libraries might hide a lot of the complexity of JWTs behind abstractions, but that doesn't mean it doesn't exist.

spookthesunset 7y ago
Oh please... you are seriously going to argue it is less complex call a database or redis than it is to locally validate a token using proven crypto methods that have existed for decades? If you are gonna play the “look under the layers of abstraction to count true complexity” game.... your assertion falls apart in a hurry. Calling a database or redis every http request is a hell of a lot more complex in terms of call stack, configuration, network dependencies and library support than JWT. But it is a stupid way to frame your argument to begin with. Both ways abstract all their doings behind a library. Both probably have almost the same general configuration foot print. And JWT has the benefit that you can still treat it like a session token and validate on every call for parts of your site that need it. Most sites do not need to instantly revoke a token everywhere! The number of detractors around here who don’t understand that last point is pretty sad...
- GordonS 7y ago
  While I think your response is overly harsh, I could have phrased my argument better. What I'm getting at is that the JWT spec has issues, JWTs are complex to get right, and they have (notorious) encryption footguns. Connecting to a database is a relatively simple affair. For the record, I'm not a JWT "detractor" (if you look elsewhere in this thread you'll find a comment where I used it to good effect).