7 ms·
May be worth mentioning--JWTs are not part of the OAuth. They're certainly used together quite a bit, but you can absolutely use regular session tokens too. I
by candiddevmike 6y ago
May be worth mentioning--JWTs are not part of the OAuth. They're certainly used together quite a bit, but you can absolutely use regular session tokens too.
I say this as someone who thought JWT was a core part of OAuth and it only added to the perceived complexity of the implementation.
- noneeeed 6y agoYeah, I've run into this recently while adding SCIM support to our system. I had to reread the RFCs and docs repeatedly to reassure myself that JWTs were not actually a requirement for the OAuth2 bearer token. It's complete overkill for what we need but the implementation lib I was trying to use assumes it and it was really complicating things unnecessarily.
- deathanatos 6y ago> May be worth mentioning--JWTs are not part of the OAuth /OIDC standard. JWTs are a part of the OIDC standard; from the standard itself[1], > The primary extension that OpenID Connect makes to OAuth 2.0 to enable End-Users to be Authenticated is the ID Token data structure. The ID Token is a security token that contains Claims about the Authentication of an End-User by an Authorization Server when using a Client, and potentially other requested Claims. The ID Token is represented as a JSON Web Token (JWT) [JWT]. But your comment sounds like you're conflating OAuth & OIDC. (It is true for OAuth that you're not required to use JWTs.) [1]: https://openid.net/specs/openid-connect-core-1_0.html#IDToken https://openid.net/specs/openid-connect-core-1_0.html#IDToke...
- candiddevmike 6y agoMy bad, yes I meant only OAuth.
- user5994461 6y agoYou were correct though, JWT was not part of the OIDC standard. JWT was created separately and added retroactively later as the standard token format.