3 ms·

Because a lot of people see security in terms of black and white instead of a lot of shades of gray. Not everything requiring authentication is your bank accoun

Because a lot of people see security in terms of black and white instead of a lot of shades of gray. Not everything requiring authentication is your bank account. HN, for example, could have even a 10 minute window and be okay. Not having to block all your request waiting for the auth backend can improve your latency by a non-trivial amount. It also can make your auth server much less complex. JWT is awesome. People just think it is "all or nothing" and implement it wrong.

ryan-allen 5y ago
> JWT is awesome. That's generally my thought, too. In my career the authentication sophistication was always a trade off (effort vs security) based on how paranoid the org felt about certain things. Having worked on PHP/Rails/.NET Webforms/Node.js apis/C# webapis the session management techniques are all very different. Having run high traffic websites also, the ability to offload logged-in sessions into JWT was really, really nice. Not having to prune auto-generated sessions from disk of PHP applications is a nice thing to not worry about.