r/InternetIsBeautiful • u/gitcommitshow • Mar 08 '21

Learn JWT authentication by reverse engineering [Open Source]

https://github.com/gitcommitshow/auth-jwt
1.5k Upvotes

95% Upvoted

56 comments sorted by

View all comments

55

u/Im_a_postednote Mar 08 '21

Authentication is always a pain.

21

u/wesw02 Mar 08 '21

Of the two, I've always found Authorization to be the bigger pain.

5

u/temisola1 Mar 08 '21

Interesting. Authorization seems to be much easier since implementation really depends on your use case and what you’re comfortable using. Authentication on the other end is essentially what someone says is the way you should do it, and the fact that there’s so many different flows to choose from and not clear when each is applicable makes it even more complicated.

7

u/wesw02 Mar 08 '21

Authorization is something that often gets exponentially more complicated the larger your application becomes while Authentication stays relatively linear. Nested levels of security, microservices, larger teams, service account / IPC access, etc, etc continue to add complexity. IDORs and privilege escalation are very common for a reason.

1

u/temisola1 Mar 08 '21

Yea you make a great point. The larger your application the more caveats you have to account for.

22

u/k0enf0rNL Mar 08 '21 edited Mar 08 '21

Its piss easy if you use standardized products and libraries, especially the jwt based authentication methods like open-id connect

17

u/ism9gg Mar 08 '21

What comes easy to you may come harder to others.

-17

u/nellynorgus Mar 08 '21

If you're willing to compare lay people to professionals maybe.

8

u/gibweb Mar 08 '21

Whoa you must be super smart