4 ms·
JWTs can do that (delegate) and such capability is already well defined.
by jiveturkey 4mo ago
JWTs can do that (delegate) and such capability is already well defined.
- saganus 4mo agoMaybe I stated it wrong. Macaroons have the ability to attenuate the restrictions _without_ contacting the auth server, which makes it IMO fit for restricting and attenuating as much as you want, without much cost. If I need a roundtrip to the auth server to attenuate, I am not necessarily going to do it as often.
- tptacek 4mo agoMost token formats delegate. Macaroons support attenuation, confinement, and embedded third-party claims, none of which are JWT capabilities.