4 ms·

I'd like to mention here that PASETO is a safer JWT alternative: https://github.com/paragonie/paseto https://github.com/paragonie/paseto

itake 6y ago
For the uninitiated: > Unlike JSON Web Tokens (JWT), which gives developers more than enough rope with which to hang themselves, Paseto only allows secure operations. JWT gives you "algorithm agility", Paseto gives you "versioned protocols". It's incredibly unlikely that you'll be able to use Paseto in an insecure way.
- StavrosK 6y ago
  Thank you, sorry, I probably should have included that.
Sohcahtoa82 6y ago
I have yet to see a criticism of JWT that doesn't devolve into developers not understanding them and/or misusing them. Like, I know some devs use them for stateless auth, which means you can't revoke a token, so a stolen token is guaranteed valid until expiration, but I'd file that under misuse.
- StavrosK 6y ago
  Hmm, I'm not understanding your point. You say you haven't seen a criticism of JWT that's not just "they're very hard to use correctly", as if that invalidates that criticism. JWTs are very hard to use correctly. That's the entire problem. Don't use them. Use PASETO.
  - Sohcahtoa82 6y ago
    More like... They're easy to use correctly, but just as easy to use incorrectly. But this applies to a lot of technologies. Some people treat Base64 like encryption. I've seen passwords stored in databases with Base64 encoding. It doesn't mean Base64 is terrible and insecure, it just means it's being used incorrectly.
    - StavrosK 6y ago
      I mean, if the official base64 website said "base64 is an open, industry standard method for storing passwords securely in databases", I'd agree with you, but it's only JWT.io that makes that claim. If you're making a security library that's easy to use incorrectly, it's not easy to use correctly, and it's probably more of an insecurity library.

itake 6y ago

For the uninitiated: > Unlike JSON Web Tokens (JWT), which gives developers more than enough rope with which to hang themselves, Paseto only allows secure operations. JWT gives you "algorithm agility", Paseto gives you "versioned protocols". It's incredibly unlikely that you'll be able to use Paseto in an insecure way.

StavrosK 6y ago
Thank you, sorry, I probably should have included that.

Sohcahtoa82 6y ago

I have yet to see a criticism of JWT that doesn't devolve into developers not understanding them and/or misusing them. Like, I know some devs use them for stateless auth, which means you can't revoke a token, so a stolen token is guaranteed valid until expiration, but I'd file that under misuse.

StavrosK 6y ago
Hmm, I'm not understanding your point. You say you haven't seen a criticism of JWT that's not just "they're very hard to use correctly", as if that invalidates that criticism. JWTs are very hard to use correctly. That's the entire problem. Don't use them. Use PASETO.
- Sohcahtoa82 6y ago
  More like... They're easy to use correctly, but just as easy to use incorrectly. But this applies to a lot of technologies. Some people treat Base64 like encryption. I've seen passwords stored in databases with Base64 encoding. It doesn't mean Base64 is terrible and insecure, it just means it's being used incorrectly.
  - StavrosK 6y ago
    I mean, if the official base64 website said "base64 is an open, industry standard method for storing passwords securely in databases", I'd agree with you, but it's only JWT.io that makes that claim. If you're making a security library that's easy to use incorrectly, it's not easy to use correctly, and it's probably more of an insecurity library.