3 ms·
Hmm, I'm not understanding your point. You say you haven't seen a criticism of JWT that's not just "they're very hard to use correctly", as if that invalidates
by StavrosK 6y ago
Hmm, I'm not understanding your point. You say you haven't seen a criticism of JWT that's not just "they're very hard to use correctly", as if that invalidates that criticism.
JWTs are very hard to use correctly. That's the entire problem. Don't use them. Use PASETO.
- Sohcahtoa82 6y agoMore like... They're easy to use correctly, but just as easy to use incorrectly. But this applies to a lot of technologies. Some people treat Base64 like encryption. I've seen passwords stored in databases with Base64 encoding. It doesn't mean Base64 is terrible and insecure, it just means it's being used incorrectly.
- StavrosK 6y agoI mean, if the official base64 website said "base64 is an open, industry standard method for storing passwords securely in databases", I'd agree with you, but it's only JWT.io that makes that claim. If you're making a security library that's easy to use incorrectly, it's not easy to use correctly, and it's probably more of an insecurity library.