4 ms·

There's nothing actually wrong with session ids in a cookie. It's that JWT was the new hotness and a buzzword. Now there's a lot of cargo culting around them.

There's nothing actually wrong with session ids in a cookie. It's that JWT was the new hotness and a buzzword. Now there's a lot of cargo culting around them. JWTs are a signed claim that your service can trust, and use for authorization after just verifying the signature. A session id, you need to take the id and look up your session in some mechanism on your backend. JWTs are great for different services saying 'yes, this connection is actually this person, trust them.' Inter-server communication, oauth, etc, are good examples. Session ids only work for the issuing service. Django sessions, php sessions, etc, are good examples. One of the biggest problems with JWTs is that a lot of people are ONLY storing a user_id, or a session_id in them. On the server the decode the token and proceed with the standard session_id workflow, still hitting the db. Invalidation is another thing. You still end up hitting the database, and if the JWT is only ever used by your own service, why bother? Then there's people just shooting themselves in the foot and not actually signing them and just trusting them without any crypto signatures.

xtracto 4y ago
>Then there's people just shooting themselves in the foot and not actually signing them and just trusting them without any crypto signatures. You would be surprised, a very short time ago I saw a (pretty large/common) web FinTech service provider that included the private key to verify the signature encoded within the JWT. It was SHOUTING to be hacked. I don't understad how people can be so irresponsible.
- Salgat 4y ago
  You mean the public key? The private key is what's used to sign tokens, the public key is used to verify the signature and can be freely shared. Or maybe you mean they used a symmetric key and shared that?
  - ehutch79 4y ago
    I'm pretty sure he meant they were putting the private key in the jwt. People do some dumb stuff. And the dunning kruger effect is all too real.
    - Salgat 4y ago
      He said it was used to verify the token, which is only true if you use a symmetric key not a private key.
      - ehutch79 4y ago
        Right, from what they're saying, they're pulling the key out of the claims to verify the token. No it doesn't make sense.
  - xtracto 4y ago
    Private key to SIGN the content.
    - P5fRxh5kUvp2th 4y ago
      what am I missing? a JWT signature is the header and payload encrypted and attached. You would do that encryption via a private key, said public key would be used to verify it was encrypted by the private key. What does "to SIGN" mean in this context?
- ehutch79 4y ago
  Because they got the code our of a reddit comment?
newaccount2021 4y ago
andrewstuart2 4y ago
The "problem" is that JWTs are just a container format. There's nothing saying they even have to be signed, though they're designed to be more easily signed or encryptable. I've implemented the ridiculous SAML enveloped encryption/signature standard and canonicalization, and honestly, the simplicity of JWT while still providing for resilient security is a fine reason for its popularity when compared to some of the alternatives for federated id/authentication. The right thing to do is use web standards (like OIDC) and libraries and existing tools (keycloak, ory suite, et al), same as with cookies. You can do the wrong things with both JWTs and cookies, and any other client-identifying technology.
prpl 4y ago
not sure it is new hotness anymore. Maybe in 2016, when it was still several years old and people still had tons of issues with it.

xtracto 4y ago

>Then there's people just shooting themselves in the foot and not actually signing them and just trusting them without any crypto signatures. You would be surprised, a very short time ago I saw a (pretty large/common) web FinTech service provider that included the private key to verify the signature encoded within the JWT. It was SHOUTING to be hacked. I don't understad how people can be so irresponsible.

Salgat 4y ago
You mean the public key? The private key is what's used to sign tokens, the public key is used to verify the signature and can be freely shared. Or maybe you mean they used a symmetric key and shared that?
- ehutch79 4y ago
  I'm pretty sure he meant they were putting the private key in the jwt. People do some dumb stuff. And the dunning kruger effect is all too real.
  - Salgat 4y ago
    He said it was used to verify the token, which is only true if you use a symmetric key not a private key.
    - ehutch79 4y ago
      Right, from what they're saying, they're pulling the key out of the claims to verify the token. No it doesn't make sense.
- xtracto 4y ago
  Private key to SIGN the content.
  - P5fRxh5kUvp2th 4y ago
    what am I missing? a JWT signature is the header and payload encrypted and attached. You would do that encryption via a private key, said public key would be used to verify it was encrypted by the private key. What does "to SIGN" mean in this context?
ehutch79 4y ago
Because they got the code our of a reddit comment?

newaccount2021 4y ago

andrewstuart2 4y ago

The "problem" is that JWTs are just a container format. There's nothing saying they even have to be signed, though they're designed to be more easily signed or encryptable. I've implemented the ridiculous SAML enveloped encryption/signature standard and canonicalization, and honestly, the simplicity of JWT while still providing for resilient security is a fine reason for its popularity when compared to some of the alternatives for federated id/authentication. The right thing to do is use web standards (like OIDC) and libraries and existing tools (keycloak, ory suite, et al), same as with cookies. You can do the wrong things with both JWTs and cookies, and any other client-identifying technology.

prpl 4y ago

not sure it is new hotness anymore. Maybe in 2016, when it was still several years old and people still had tons of issues with it.