3 ms·
I evaluated JWT recently and found it so overcomplex and full of footguns that it was unacceptable for a security-critical component. It boggles the mind that t
by ddevault 6y ago
I evaluated JWT recently and found it so overcomplex and full of footguns that it was unacceptable for a security-critical component. It boggles the mind that this was designed as recently as 2015.
I plan on going for a simple bespoke solution which just uses an off-the-shelf algorithm to sign a structured payload (likely BARE), which in addition to being less full of shit will make for smaller and more managable tokens.
- kamyarg 6y agoCan you elaborate on this? > ... full of footguns that it was unacceptable for a security-critical component. What it not secure about it?
- ddevault 6y agoSee TFA for a subset of the problems. Security should be designed so that it's easy to do it right and hard to do it wrong, but JWT offers many opportunities to do it wrong. Maybe you can figure it out with enough reading of TFA and other articles online, but there's no reason to take a risk on such a shoddy security standard in the first place.