3 ms·
To make things easy I usually use "alg":"none". It makes using jwts a breeze. https://datatracker.ietf.org/doc/html/rfc7518#section-3.6 https://datatracker.ie
by sjaak 5y ago
To make things easy I usually use "alg":"none". It makes using jwts a breeze.
https://datatracker.ietf.org/doc/html/rfc7518#section-3.6 https://datatracker.ietf.org/doc/html/rfc7518#section-3.6
- jaywalk 5y agoI hope this is a joke.
- sjaak 5y agoIt was, but judging by the downvotes my delivery was off :)
- mooreds 5y agoLike a sibling comment said, hopefully this was tongue in cheek. If you use "none", anyone can forge a JWT that says anything. I always say: * You should have some other way of verifying that the JWT was unchanged by the client, like say being on a private network or using client TLS certs and * You should benchmark and know that the signing overhead is a significant source of performance degradation in your system. Otherwise, sign your JWTs! :)
- commandlinefan 5y agoI recently discovered the TLS_NULL_WITH_NULL_NULL SSL ciphersuite (https://datatracker.ietf.org/doc/rfc5246/ https://datatracker.ietf.org/doc/rfc5246/) - it makes analyzing network traffic so much simpler, and you don't even have to deal with certificates any more!