3 ms·

> OAuth uses access tokens, which are typically, but not limited to, JSON Web Tokens This claim is misguided, but I hear it quite often. JWT is a very popular

> OAuth uses access tokens, which are typically, but not limited to, JSON Web Tokens This claim is misguided, but I hear it quite often. JWT is a very popular (and downright terrible[1]) format, but I there is no evidence that most of the tokens use JWT. It could be worse - I've heard some people claiming with confidence that OAuth mandates JWT. The reality is that OAuth 2.0 predates JWT, and the implicit assumption was that all tokens are stateful. The access tokens in the examples are all short, and the spec strongly recommends revoking access tokens in case of access code reuse. This makes JWT access tokens a non-canonical implementation of OAuth 2.0. You could add a "jti" claim (or "uti" claim in case of Microsoft) and then check for revocations in Redis, but then your only achievement was bloating up your access tokens by a factor of 20. Congratulations! That's the reason why the other Big Tech companies are not using JWT for Access Tokens. It just doesn't make sense when you are at the scale where you need access tokens to be small and moderately long-lived. Users of JWT are more heavily concentrated on the smaller scale: more recent startups and enterprise customers. --- [1] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...

notpushkin 2y ago
> Users of JWT are more heavily concentrated on the smaller scale JWT isn't particularly useful for the smaller scale either: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/ http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo...
- sampullman 2y ago
  After reading that article a while back it wasn't really clear to me why JWTs are necessarily a bad choice for authentication, aside from the issue of invalidating stateless tokens. The main argument seems to be vulnerability to attacker supplied JS (when kept in local storage). But if you're targeted by a supply chain attack, I assume you have a lot more to worry about than token exfiltration. The complaint about lack of battle-tested JWT implementations seems outdated as well.
nmadden 2y ago
There’s a lot to say about the problems of JWTs, but they absolutely are extremely widely used for access tokens, and by many big players (Microsoft, Okta, etc). The JWT RFC is a product of the OAuth working group.

notpushkin 2y ago

> Users of JWT are more heavily concentrated on the smaller scale JWT isn't particularly useful for the smaller scale either: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/ http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo...

sampullman 2y ago
After reading that article a while back it wasn't really clear to me why JWTs are necessarily a bad choice for authentication, aside from the issue of invalidating stateless tokens. The main argument seems to be vulnerability to attacker supplied JS (when kept in local storage). But if you're targeted by a supply chain attack, I assume you have a lot more to worry about than token exfiltration. The complaint about lack of battle-tested JWT implementations seems outdated as well.

nmadden 2y ago

There’s a lot to say about the problems of JWTs, but they absolutely are extremely widely used for access tokens, and by many big players (Microsoft, Okta, etc). The JWT RFC is a product of the OAuth working group.