3 ms·
Apart from the issue of not being able to log out there is the following list in the article: "We've ignored things like increased attack surface due to comple
by weinzierl 4y ago
Apart from the issue of not being able to log out there is the following list in the article:
"We've ignored things like increased attack surface due to complexity of JSON parsing/validation, misconfiguring JWT libraries to allow no signature, leaking data to users because you thought JWTs were encrypted (they're usually not by default), and poor implementation of API clients that don't properly re-run requests that failed due to expired JWTs. The list goes on, and on, and on ..."
All of these sound like usability issues. Not to downplay them but are there more serious issues with JWTs?
- pionar 4y agoIt's like C. The language is fine, it just allows you to do bad things too easily. The same is true with JWTs. The idea is fine, but allows you to do bad things too easily. The no signature bit was a huge flaw in almost all JWT libraries across languages a few years ago. There are better schemes out there.