4 ms·

> If the simple thing is sufficient, don't do the complex thing. I fail to see how JWT is complex. It is actually quite simple--it's bog standard public key cr

> If the simple thing is sufficient, don't do the complex thing. I fail to see how JWT is complex. It is actually quite simple--it's bog standard public key cryptography. Hell for most requests, even your damn load balancer can validate the auth token, your front-end servers might not even see the request for an expired token! I would assert all these homegrown "just throw a redis instance at it" solutions are far more complex. Now you gotta deal with cache invalidation and that isn't fun. Plus it is a network request, and that takes a long time... time which I could spend doing something more useful for my customer. The decision tree for JWT is easy: - Is the token expired? Yes -- Return 403 (note: your load balancer can do this) - Is it for a "sensitive request"? Yes? Verify token against auth server - All other requests (99% of your traffic) - Validate the token locally.

treve 5y ago
I've provided data in my article of many instances where people got JWT wrong, including an example from Auth0. I wouldn't call myself a security researcher, but many who are have also said this. Your comment that it's 'actually pretty easy' feels pretty reductive. If you're really making this argument, I feel it would be good to provide some evidence. I've been doing this for a while, and in my experience a large group of devs would likely not be able to explain public key cryptography, despite having ownership over features and/or applications. This is not just about you and what you find easy, this is about the entire community with a huge variety of experience levels.
- spookthesunset 5y ago
  I did... I made a decision tree. It's really that easy. The hard part is deciding what requests are sensitive and which aren't and that's a business decision not an engineering decision. Adding redis or some crazy pub-sub crap to deal with logged out tokens.... that is truly making it far more complex. JWT is all about you deciding which pages truly need real-time "this token is invalid" and which don't. Once you decide all requests need real-time you either are lying to yourself or JWT truly isn't the correct answer.
  - treve 5y ago
    > I did... I made a decision tree. It's really that easy I think we are past an intellectually honest discussion. Disappointing. Good luck with everything.
    - spookthesunset 5y ago
      Good luck too. It really is easy though. That is the flowchart you need to use. Dunno what else to say.
  - nichch 5y ago
    You keep parroting "complexity", yet in your original argument you stated that for "sensitive" requests, you should just hit the backend anyway. So that implies that you already have a database setup and you are already using it in your app. That means there is zero extra operational or deployment complexity (compared to implementing a completely new and different bloated system.) As for development complexity? var isTokenValid = await redis.get(`k:${token}`); if(isTokenValid != null) return next(); return res.status(401).send('Unauth.');
    - spookthesunset 5y ago
      So all that network latency and cache validation come for free? What if the system isn't in the same LAN and has a few hops... hops that may involve the speed of light over a few thousand miles and all it's slowness... I don't think you've thought about the problem space enough.
      - seanieb 5y ago
        > I don't think you've thought about the problem space enough. God grant me the self confidence of this fella. I’ve been working as infosec engineer and been arguing with frontend engineers ( note its usually an individual) wanting to implement JWTs for years. Large companies with complex distributed systems, and the expertise to run them, however unless you’re doing some heavy API stuff or you’re Google scale it almost always is the wrong choice ( more often the request highlights an engineer who had almost exclusively been in the JS ecosystem and has very little backend experience).
bvrmn 5y ago
It's funny how for "can be done right" guy you propose to use 403 for obvious auth required.
- spookthesunset 5y ago
  Meh.... I don't know the exact code and didn't want to look it up. The point is... you say "dude, this token is invalid... try again".
  - tatersolid 5y ago
    Per specification, 400-series errors mean “don’t try again”.
stickfigure 5y ago
I generally agree with most of what you've said about JWT, but I think it's better retrofitted after you have performance issues. First pass, just do a database query! Most startups never hit the limits of this approach. It's hard to get simpler. Second pass, cache the state in memcache. If you're on app engine or heroku or some other paas, you already have it available. Even fewer startups hit this limit. Third pass, it's time to break out JWT. Congratulations, this is a great problem to have.

treve 5y ago

I've provided data in my article of many instances where people got JWT wrong, including an example from Auth0. I wouldn't call myself a security researcher, but many who are have also said this. Your comment that it's 'actually pretty easy' feels pretty reductive. If you're really making this argument, I feel it would be good to provide some evidence. I've been doing this for a while, and in my experience a large group of devs would likely not be able to explain public key cryptography, despite having ownership over features and/or applications. This is not just about you and what you find easy, this is about the entire community with a huge variety of experience levels.

spookthesunset 5y ago
I did... I made a decision tree. It's really that easy. The hard part is deciding what requests are sensitive and which aren't and that's a business decision not an engineering decision. Adding redis or some crazy pub-sub crap to deal with logged out tokens.... that is truly making it far more complex. JWT is all about you deciding which pages truly need real-time "this token is invalid" and which don't. Once you decide all requests need real-time you either are lying to yourself or JWT truly isn't the correct answer.
- treve 5y ago
  > I did... I made a decision tree. It's really that easy I think we are past an intellectually honest discussion. Disappointing. Good luck with everything.
  - spookthesunset 5y ago
    Good luck too. It really is easy though. That is the flowchart you need to use. Dunno what else to say.
- nichch 5y ago
  You keep parroting "complexity", yet in your original argument you stated that for "sensitive" requests, you should just hit the backend anyway. So that implies that you already have a database setup and you are already using it in your app. That means there is zero extra operational or deployment complexity (compared to implementing a completely new and different bloated system.) As for development complexity? var isTokenValid = await redis.get(`k:${token}`); if(isTokenValid != null) return next(); return res.status(401).send('Unauth.');
  - spookthesunset 5y ago
    So all that network latency and cache validation come for free? What if the system isn't in the same LAN and has a few hops... hops that may involve the speed of light over a few thousand miles and all it's slowness... I don't think you've thought about the problem space enough.
    - seanieb 5y ago
      > I don't think you've thought about the problem space enough. God grant me the self confidence of this fella. I’ve been working as infosec engineer and been arguing with frontend engineers ( note its usually an individual) wanting to implement JWTs for years. Large companies with complex distributed systems, and the expertise to run them, however unless you’re doing some heavy API stuff or you’re Google scale it almost always is the wrong choice ( more often the request highlights an engineer who had almost exclusively been in the JS ecosystem and has very little backend experience).

bvrmn 5y ago

It's funny how for "can be done right" guy you propose to use 403 for obvious auth required.

spookthesunset 5y ago
Meh.... I don't know the exact code and didn't want to look it up. The point is... you say "dude, this token is invalid... try again".
- tatersolid 5y ago
  Per specification, 400-series errors mean “don’t try again”.

stickfigure 5y ago

I generally agree with most of what you've said about JWT, but I think it's better retrofitted after you have performance issues. First pass, just do a database query! Most startups never hit the limits of this approach. It's hard to get simpler. Second pass, cache the state in memcache. If you're on app engine or heroku or some other paas, you already have it available. Even fewer startups hit this limit. Third pass, it's time to break out JWT. Congratulations, this is a great problem to have.