3 ms·

Aren't JWTs just fancy cookies?

• freeqaz 4y ago
  JWTs are frequently stored in LocalStorage which means that any XSS is able to leak the JWT. Cookies, on the other hand, can be configured to be HTTP-Only and inaccessible to JavaScript on the page. That prevents somebody with XSS from leaking the value without a second server-side vulnerability or weakness. In addition, JWTs are impossible to revoke without revoking _all_ sessions. This is the biggest weakness, imo, and the reason that they shouldn't be used client-side. I'm a huge fan of the approach the Ory is taking with Oathkeeper and Kratos: https://www.ory.sh/docs/kratos/guides/zero-trust-iap-proxy-identity-access-proxy https://www.ory.sh/docs/kratos/guides/zero-trust-iap-proxy-i...
  • nijave 4y ago
    Can't you revoke them the same way you revoke any other auth token and put the token ID in a database somewhere?
    • waplot 4y ago
      it won't be stateless then, and you might as well just use traditional sessions then
• ryanbrunner 4y ago
  Sure, but browsers have done a lot of work to make cookies far more convenient (they're automatically sent with requests, you have browser APIs to work with them), and secure (Secure, HttpOnly, SameSite, etc.)
• nijave 4y ago
  Cookies are a storage and transport mechanism and JWTs are signed JSON blobs. You could put a JWT inside a cookie.