3 ms·

JWT are useful where logouts are rare (games/apps), high API volume or some latency between logout and actual logout is acceptable. Think of apps like Uber. Mi

JWT are useful where logouts are rare (games/apps), high API volume or some latency between logout and actual logout is acceptable. Think of apps like Uber. Millions of DAU, but rarely people explicitly log out. If your logged-out user list is 5-6 order smaller than active users, it is easy to replicate/cache that. Very high API volume to many different services. Apart from few, majority of APIs won't have major security implication, if called by a rogue actor calls them. So yeah, banks shouldn't use them, Farmville/Uber using them is perfectly fine.

mastazi 5y ago
> So yeah, banks shouldn't use them, Farmville/Uber using them is perfectly fine. That is true (and I think the author agrees with you in the article, see the par. about scalability). However, many of us are not working at banks, or at companies that have the scale of Uber. My main takeaway from the article, is that if you are neither of those, you might still want to opt for traditional sessions.
lucian1900 5y ago
Games need the ability to ban players immediately, which at the very least requires a centrally stored blacklist. That means either a query for every request or pushing the blacklist somehow.
- c0wb0yc0d3r 5y ago
  > Games need the ability to ban players immediately Do they? I haven't cheated in games for years, but the only game I can think of that took any immediate action was StarCraft: Brood War. There were a few hacks that would result in your removal instantly. You were not banned, just disconnected. Halo 2, WoW, RuneScape all banned cheaters in waves. As far as I know they did this as a measure to further impede the cheaters trying to run tests about what actions and behaviors result in negative consequences. My (naive) approach would be short lived tokens, and a mechanism for disabling and accounts ability to refresh said tokens. I wouldn't mix account management and billing with gameplay. This would in turn force users to open a different session when trying to access this authenticated data and effectively block bad actors immediately.

mastazi 5y ago

> So yeah, banks shouldn't use them, Farmville/Uber using them is perfectly fine. That is true (and I think the author agrees with you in the article, see the par. about scalability). However, many of us are not working at banks, or at companies that have the scale of Uber. My main takeaway from the article, is that if you are neither of those, you might still want to opt for traditional sessions.

lucian1900 5y ago

Games need the ability to ban players immediately, which at the very least requires a centrally stored blacklist. That means either a query for every request or pushing the blacklist somehow.

c0wb0yc0d3r 5y ago
> Games need the ability to ban players immediately Do they? I haven't cheated in games for years, but the only game I can think of that took any immediate action was StarCraft: Brood War. There were a few hacks that would result in your removal instantly. You were not banned, just disconnected. Halo 2, WoW, RuneScape all banned cheaters in waves. As far as I know they did this as a measure to further impede the cheaters trying to run tests about what actions and behaviors result in negative consequences. My (naive) approach would be short lived tokens, and a mechanism for disabling and accounts ability to refresh said tokens. I wouldn't mix account management and billing with gameplay. This would in turn force users to open a different session when trying to access this authenticated data and effectively block bad actors immediately.