3 ms·
A way it would be useful without sessions is if you have a webapp that loads a list of email addresses on startup. For each request that comes in, it checks if
by anderspitman 7y ago
A way it would be useful without sessions is if you have a webapp that loads a list of email addresses on startup. For each request that comes in, it checks if the request has an emauth JWT (maybe passed in a Emauth-Token header). If it does, it verifies the sig, then checks the contained email address against the whitelist. If it matches the request goes through.
- y4mi 7y agoYeah, but how would you log a user out? Delete the local token? And if someone got access to the token, your account will be owned forever with no way to revoke the access. Unless you auto expire them... Now you need a flow to refresh the tokens.... If you implement jwt, you will need sessions and all other features authentication servers have... It would be way easier to implement a custom authentication flows mimicking your email auth than recreating everything else. I think your service is good as is and introducing jwt to it would be a net-negative But I'm just a random person from the internet, do whatever you feel like doing ;)
- anderspitman 7y agoSorry, I didn't notice you had responded. I think maybe you're reading too much into adding JWTs to emauth.io. It simply provides another source of information, ie that as of a certain time, emauth.io verifies that the holder of this token had control over the email address. Implementations can do whatever they want with that information, depending on their threat model. And since previously the API was returning a fairly redundant text response (status code already tells you whether verification was successful), returning the JWT doesn't interfere with the previous functionality.