Comment on: Biscuit authorization
Include an expiry time in the encrypted part. The encryption, and the fact the token decrypts invalidly if not encrypted with the correct key, acts like a discount JWT.Encrypted session tokens with embedded expiry will serve the needs of 99% of applications/services.
Comment on: Should I use JWTs for authentication tokens?
I feel ya.You have to store invalidated tokens anywhere they might pass through a service, which means you have to persist them for as long you can predict that there expiry will last. Simply putting them in a memory database isn't 100% if that db gets flushed, and then you might start storing them in a disk database, which at that point, you might as well have just read the db in the first place using cookie auth.In microservices, you generally have to put an invalidated JWT cache between every service, or compromised JWT's are just floating around your intranet.I've worked at a plethora of p
Comment on: Should I use JWTs for authentication tokens?
I keep reading criticism of JWTs that involves impersonation or replay attacks. With JWT (or non JWT bearer tokens) you use a refresh token. It seems to me that if an attacker gets a JWT they also have the refresh token. So how are JWTs inherently more insecure than other authentication methods? Almost all data passed over the wire nowadays is TLS encrypted.In my projects, we have used encrypted JWTs and it seems to me a fine solution. Log out can be implemented in a user facing client by deleting the JWT and refresh token. Given a short enough expiration time, this is sufficient for most use
Comment on: Stop Using JWTs
What a bunch of BS...The JWT specification is specifically designed only for very short-live tokens (~5 minute or less). Sessions need to have longer lifespans than that.Huh? The expiry is as long or short as you want.The JWT specification itself is not trusted by security experts....and we're supposed to trust some random gist? Pure appeal to authority.