4 ms·
Leveraging the Encrypted Token Pattern
- chatmasta 12y agoMaybe I missed something, but I was surprised there was no mention of JSON Web Tokens (JWT). See [0] (overview) and [1] (example usage). [0] http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html http://self-issued.info/docs/draft-ietf-oauth-json-web-token... [1] https://github.com/mattupstate/flask-jwt https://github.com/mattupstate/flask-jwt
- cjlarose 12y agoAt the time of writing (September 2013), the JWT spec would have been only on it's 12th draft--it's had 19 follow-up drafts since then. It's possible that the author didn't know about them at all.
- paulmooney 12y agoAs you say, the JWT spec was not as mature at the time of writing.
- chatmasta 12y ago(Assuming you're the author -- who knows though.) Now that the JWT spec is mature and there are some nice implementations of it, do you think it's a good option for token-based authentication?
- paulmooney 12y agoYes, I'm the author. Long as the JWT spec implements a strong method of encryption , it's a good option.
- paulmooney 12y agoThe JWT was not as mature at the time of writing. In any case, The structure of the token itself is open for extension. The pattern focuses on the manner in which the token is leveraged.
- duergner 12y agoDid I miss something in that pattern or is this just some kind of OAuth2.0 Bearer Token implementation within one domain?
- paulmooney 12y agoThere is no explicit relationship between this pattern and OAuth. The structure of the token itself is open for extension. The pattern focuses on the manner in which the token is leveraged.