3 ms·
Certainly there are! Nobody's saying otherwise. But they are few, they are far between, and if they manage anything important they should be using OAuth to vali
by eropple 7y ago
Certainly there are! Nobody's saying otherwise. But they are few, they are far between, and if they manage anything important they should be using OAuth to validate identity and provide credentials that the services check on-request.
- magicalhippo 7y agoThat's exactly what they're doing, using JWT for OAuth 2.0 bearer tokens.
- eropple 7y agoWhich is not checking on-request. If a token is invalidated, it must be rejected inline. Otherwise, you're just fucking around. Which, if you aren't doing anything important, sure, fine--the problem is that most of the folks who leap to poorly-specified jank like JWT are doing important things with tools they don't understand and the people that are impacted are downstream of them.
- magicalhippo 7y agoNot sure what you mean, and I might have explained their setup wrongly, I'm no expert in this. I ask for an access token from auth server, I pass access token to API server, API server optionally checks with auth server if token is ok, or if token is self-contained, verifies signature, checks expiration time etc. Obviously self-contained tokens cannot be revoked, they can only expire. For this service, JWT is used when requesting an access token, and as an access token for self-contained tokens.