joepie91

Yeah, there is this classic: http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions…

I've been fond of [1] and [2] for a more focused argument against JWT for sessions. The JOSE standards (of which JWT is a member) are error-prone and have had numerous critical security-affecting bugs due to how they were designed. [3] To remedy that, I proposed PASETO. [4] I still don't recommend PASETO for sessions, because of the arguments laid out in [1] and [2]. [1] http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… [2] http://cryto.net/%7Ejoepie91/blog/2016/06/19/stop-using-jwt-for-sessio… [3] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard… [4] https://paseto.io

I found this to be a great resource when groking your question recently http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… Also this previous HN thread https://news.ycombinator.com/item?id=13865459

A common security issue I've seen with uses of JWT doesn't have to do with JWT itself but how it's used by front-end developers. It's commonly stored in localStorage instead of an HttpOnly cookie, which creates a cross-site scripting vulnerability. More details here: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… Shockingly, the advice I've seen to protect against this by folks like Auth0 is "keep your tokens expiration low" or not mention it at all. I don't imagine PAST gets around this, as it's more like misinformation around the storage mechanism, but I think it's worth mentioning in any "how to use" section about PAST or JWT.

Rather than just "JWT is awesome..." wouldn't it be more sensible and responsible to caveat this with some of the drawbacks? I read this article recently (http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… that proposes not to use it for sessions but instead for the use cases listed at the end of the article. Follow-up article here http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions… Also this https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web…

Also, worth mentioning this article as an opinion: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… Edit: Title is Stop using JWT for sessions

well, in mongo's case, there has been some rather strong criticism leveled at it over time.[1][2][3] some aspects have probably improved, but (as i don't follow mongo) i can't say how proactive and public mongo's owner has been in addressing criticisms. [1] http://cryto.net/~joepie91/blog/2015/07/19/why-you-should-never-ever-e… [2] http://www.sarahmei.com/blog/2013/11/11/why-you-should-never-use-mongo… [3] https://aphyr.com/posts/322-call-me-maybe-mongodb-stale-reads

There are many drawbacks when using MongoDB, especially in the development time department: http://cryto.net/~joepie91/blog/2015/07/19/why-you-should-never-ever-e… It's a completely fallacious argument. Using MongoDB doesn't save you time, it just shifts the effort towards a later point, where it will require several times as much effort to fix shit, which may not even succeed and you may end up with corrupted data. It's really not worth it.

One of the articles that TFA links to [0] contains the following paragraphs: > And there are more security problems. Unlike sessions - which can be invalidated by the server whenever it feels like it - individual stateless JWT tokens cannot be invalidated. By design, they will be valid until they expire, no matter what happens. This means that you cannot, for example, invalidate the session of an attacker after detecting a compromise. You also cannot invalidate old sessions when a user changes their password. > You are essentially powerless, and cannot 'kill' a session without building complex (and stateful!) infrastructure to explicitly detect and reject them, defeating the entire point of using stateless JWT tokens to begin with. I'm not sure that this is entirely true. Typically, the total number of non-expired issued tokens is much higher than the number of invalidated unexpired tokens. Therefore, if you store only invalidated tokens and delete them when they get expired, you can significantly reduce the amount of required storage and the cost of lookup. Although, in any real application the performance gains will be minuscule (compared to the cost of, you know, everything else. Auth is just a small part) and probably not worth the extra complexity. [0] "Stop using JWT for sessions" - http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions…

I use better auth for a real app There is a plugin provided by better auth for jwt https://www.better-auth.com/docs/plugins/jwt We dont need it since everything is a single "server" and cookies are good enough. JWT would be added complexity ( e.g sign out ) that i find it better to not be set as a default. bonus reading http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions…

Mostly incompetence. http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… http://cryto.net/%7Ejoepie91/blog/2016/06/19/stop-using-jwt-for-sessio…

> Users of JWT are more heavily concentrated on the smaller scale JWT isn't particularly useful for the smaller scale either: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions…

The person who created the gist has this on their website "Available payment methods include PayPal, Bitcoin, and SEPA transfers." http://cryto.net/~joepie91/

The ability to logout existing sessions (typically either via a manual user action or automatically upon changing/resetting their password) is a desirable feature in essentially all applications where user accounts can be compromised. You can kind of fake this by using a short-lived JWT and constantly refreshing it, but this: 1. Massively increases server strain and bandwidth usage 2. Has problems with users less reliable connections (they'll be randomly logged out all the time) 3. Makes "Remember Me" style features impossible (unless you use a server-side store for that, which brings us back to it not being stateless) Here's a good graph on why $method to make JWTs work for sessions is bad: http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions… (note: for some reason the website doesn't support HTTPS :( )

There's a neat little chart which explains why you'd probably be better off not using JWT: http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions…

JWT were aiming to be stateless, yet they cannot be stateless if you need them to be revocable. If you keep using plain sessions you got a SPOF, but you are immune, for a whole lot of consistency and cred management problems. http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions…

"Why you should never, ever, ever use MongoDB" (2015): http://cryto.net/~joepie91/blog/2015/07/19/why-you-should-never-ever-e… Choose boring technology - especially for a relatively simple use case such as a CMS.

You have to make your first payment via credit card so it's not anonymous unfortunately. joepie91 maintains a list, but it looks like it's a couple of years out of date: http://cryto.net/~joepie91/bitcoinvps.html

Why not to use JWT in 3 Minutes: http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions…

And, to be clear, using them for sessions is not one of those intended use cases, as joepie91 is arguing in that article. Using an actual server-side solution is easier and safer. For posterity, here's the second part to his crusade: http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions…

The author is a bit opinionated to say the least. He's also on a crusade against JSON web tokens and MongoDB. [0] http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… [1] http://cryto.net/~joepie91/blog/2015/07/19/why-you-should-never-ever-e…

At this point I have yet to work on something that absolutely needs a NoSQL database so I may be a bit biased, but my general impression is they're a solution looking for a problem- or rather, the wrong solution to the wrong problem. I have used things like key-value stores such as memcached but it's also the kind of tools you don't use liberally unless you absolutely must. Perhaps a bit of obscurity isn't that bad of a thing after all. Doesn't help that people have been talking about the issues with NoSQL for quite a few years now [0] [0] http://cryto.net/~joepie91/blog/2015/07/19/why-you-should-never-ever-e… (although I do wonder how much of these points still apply)

On using JWT's for sessions (which I think most folks assume would be a primary use case) I found this: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… Also: it's very easy to abuse JWT tokens by storing them inappropriately... https://stackoverflow.com/a/27301616/19020

JWT is a buzzword. Some people are attracted to changing shit for the sake of it, and then encouraging others to use the new thing too, to validate their own use, and feel like they're 'ahead of the curve' on trendy tech. Rather than rehashing it all myself, I'd suggest reading http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… and https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session-to…

Doesn't the author cover this in their rebuttal (http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions… "Your blacklisting/revocation server goes down, now what?". Everything from there goes to "Congratulations! You've just re-invented sessions (only with a less battle-tested implementation) and gained nothing in the process" (Sarcasm is from the author's post, not mine!)

For example: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… Others have also argued that JWT is too complex for the problems most devs are trying to solve. That complexity can lead to more problems especially when coupled with the fact many devs do not fully grasp all the implications of using JWTs. Or at least that was my impression of the arguments. Sorry if I'm misrepresenting anyone.

This article serves as a rebuttal to http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… It deconstructs each criticism presented and explains why JWTs are a secure and elegant solution to authentication. It also goes over how one would go about implementing authentication securely using JWTs with Node + Express + Passport.js.

Because they cause more problems than they solve. A lot of the implementations _aren't even faster_, but the laundry list of security bugs they have caused is very real. Suddenly you get to worry about irrevocable tokens in order to solve scaling problems you don't have. A good intro is: http://cryto.net/~joepie91/blog/attachments/jwt-flowchart.png

Don't use JWT or local storage for storing sessions. It's pointless/potentially less secure. Just use sessions and cookies. Here are some good blog posts that explain this better than I can (the flow chart in 3 is particularly illuminating): [1] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard… [2] http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions… [3] http://cryto.net/%7Ejoepie91/blog/2016/06/19/stop-using-jwt-for-sessio…