3 ms·
> The other big mistake I've seen is encoding personal data in the token, instead of just an ID that only has meaning inside of your database. It turns out not
by chrisjarvis 6y ago
> The other big mistake I've seen is encoding personal data in the token, instead of just an ID that only has meaning inside of your database. It turns out not everyone is aware that JWT tokens are publicly decodable and that the only security is in the signing + verification. Many people I've spoke with think the token is like a hash.
I have been working as a software engineer professionally for 3 years (the entire time with web technologies) and I learned this like 4 months ago... I think there needs to be more awareness of this.
- mdaniel 6y agoAnytime one sees base64 text, have a little lookie at the decoded version, as there are usually all kinds of fascinating things that people will "encrypt" in b64
- tialaramex 6y agoAnd you aren't the only one poking around in such weakly obfuscated data. Part of the driving force behind the IETF's enthusiasm for end-to-end encryption is not high minded principles of privacy (though there certainly are plenty of people who care, not just from the EFF and ACLU) but engineers frustrated that protocols get ossified by idiots decoding packets and guessing what to allow rather than reading the documentation. If you encrypt everything, these idiots can't tell what is what and so they either block everything (which at least has the benefit of being obvious) or they give up and stop trying to do the impossible. Hooray. The idiots also write passive aggressive "informational" documents about how the sky is falling because of all this encryption, but you get used to those.
- deleted 6y ago[deleted]
- kochthesecond 6y agoI am curious, did you never even have a look at the spec?
- chrisjarvis 6y agono, never did, not a bad idea when learning about a new technology haha