Re: JWT (was: Upcoming Spring 2021 RPG enhancements)

Charles Wilt wrote:

Useful reading (this is part 2, can skip part 1 if you have a basic
understanding of JWT and user sessions)
https://supertokens.io/blog/the-best-way-to-securely-manage-user-sessions

On Wed, Apr 21, 2021 at 5:23 AM Tim Fathers <tim@xxxxxxxxxxxxx> wrote:

To be honest, I feel the post [above] actually makes my point rather better that I have been able to - I mean talk about over engineered! It literally says it's non-trivial to implement a token refresh mechanism, which is mostly only there because stateless tokens can't be revoked.

I found a bunch of other sources which corroborate Tim's position.
Perhaps the easiest to digest is this:

https://blog.logrocket.com/jwt-authentication-best-practices/

That one also links to a couple of other good ones, longer but still
quite accessible:

https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session-tokens

http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/

Note that the last one does NOT support HTTPS, which means some
browsers or browser extensions will complain that you're about to
follow an unsafe link, which is slightly ironic.

I do not have the technical knowledge to evaluate whether a
complicated scheme like that used by SuperTokens does indeed buy you
better session security compared to older, simpler, more battle-tested
schemes. It's unquestionably complex. On the plus side, SuperTokens
has already packaged up their system into something you can download
for free and host yourself. It might even work directly on IBM i with
Node.js (I have not confirmed this).

One thing stressed by almost all the articles which recommend against
JWT for sessions is that JWT is uncontroversially well-suited for
certain other uses, such as authenticating API calls.

John Y.