6 ms·

Convince AWS, Azure, Google to abandon JWT for their APIs and we’ll talk. Until then, this is pretty much noise.

by numbsafari 5y ago

ori_b 5y ago
And how, precisely, do you propose doing this convincing without popularizing the idea that it's a bad API?
- SamBam 5y ago
  Use the flaws to exploit an AWS, Azure or Google product? And if you can't, are they really flaws? Or is this just an issue of some people implementing the standard badly, and they need to be taught to use better libraries?
  - Godel_unicode 5y ago
    I might slightly amend that to the less illegal "use the flaws to submit bugs to their bounty programs and get paid for your time".
    - ori_b 5y ago
      You mean, like this? https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/ https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a... It's certainly possible to use JWT correctly, and with sufficient resources put towards auditing, most flaws will be caught. This doesn't make it a good design.
  - GoblinSlayer 5y ago
    It's linked in the article: https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ https://auth0.com/blog/critical-vulnerabilities-in-json-web-...
0xEFF 5y ago
And also GitHub, Gitlab, Auth0, OKTA, login.gov, Atlasssian, Kubernetes, Hashicorp, etc… OIDC seems to be the de-facto standard today.
- cmeacham98 5y ago
  My understanding is the use of JWTs for session management is 99% of the time bad (tldr: you think you get "stateless" sessions but in reality you still need server side state for useful features like logging out); but its use for auth (i.e. via OIDC) is a normal and good use case.
  - holtalanm 5y ago
    > in reality you still need server side state for useful features like logging out im curious about this. normally 'logging out' just involves deleting the secure http-only cookie where the jwt was stored. is there something I'm missing here?
    - pcstl 5y ago
      I believe they are mentioning the fact that the server cannot unilaterally log the user out in a "naive" JWT-based implementation without storing and checking a token blocklist - which makes the session no longer stateless.
      - holtalanm 5y ago
        I can see that. I suppose when people say they need 'server-side session storage' I start thinking of app state, but in reality it could be as simple as storing a jwt refresh token that would be considered valid.
        IggleSniggle 5y ago
        It matters in the context of folks that are trying to do a serverless architecture, sold on the idea that JWTs don’t require anything more than a function to issue auth
austincheney 5y ago
Sounds like trying to convince people to abandon IPv4 for IPv6. Even though IPv6 is a superior technology its still a tough sell. Arguments for doing nothing because change is hard make for bad technology considerations. I am not stating any opinion upon JWT or alternatives.

Convince AWS, Azure, Google to abandon JWT for their APIs and we’ll talk. Until then, this is pretty much noise.

ori_b 5y ago

And how, precisely, do you propose doing this convincing without popularizing the idea that it's a bad API?

SamBam 5y ago
Use the flaws to exploit an AWS, Azure or Google product? And if you can't, are they really flaws? Or is this just an issue of some people implementing the standard badly, and they need to be taught to use better libraries?
- Godel_unicode 5y ago
  I might slightly amend that to the less illegal "use the flaws to submit bugs to their bounty programs and get paid for your time".
  - ori_b 5y ago
    You mean, like this? https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/ https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a... It's certainly possible to use JWT correctly, and with sufficient resources put towards auditing, most flaws will be caught. This doesn't make it a good design.
- GoblinSlayer 5y ago
  It's linked in the article: https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/ https://auth0.com/blog/critical-vulnerabilities-in-json-web-...

0xEFF 5y ago

And also GitHub, Gitlab, Auth0, OKTA, login.gov, Atlasssian, Kubernetes, Hashicorp, etc… OIDC seems to be the de-facto standard today.

cmeacham98 5y ago
My understanding is the use of JWTs for session management is 99% of the time bad (tldr: you think you get "stateless" sessions but in reality you still need server side state for useful features like logging out); but its use for auth (i.e. via OIDC) is a normal and good use case.
- holtalanm 5y ago
  > in reality you still need server side state for useful features like logging out im curious about this. normally 'logging out' just involves deleting the secure http-only cookie where the jwt was stored. is there something I'm missing here?
  - pcstl 5y ago
    I believe they are mentioning the fact that the server cannot unilaterally log the user out in a "naive" JWT-based implementation without storing and checking a token blocklist - which makes the session no longer stateless.
    - holtalanm 5y ago
      I can see that. I suppose when people say they need 'server-side session storage' I start thinking of app state, but in reality it could be as simple as storing a jwt refresh token that would be considered valid.
      - IggleSniggle 5y ago
        It matters in the context of folks that are trying to do a serverless architecture, sold on the idea that JWTs don’t require anything more than a function to issue auth

austincheney 5y ago

Sounds like trying to convince people to abandon IPv4 for IPv6. Even though IPv6 is a superior technology its still a tough sell. Arguments for doing nothing because change is hard make for bad technology considerations. I am not stating any opinion upon JWT or alternatives.