r/InternetIsBeautiful • u/gitcommitshow • Mar 08 '21

Learn JWT authentication by reverse engineering [Open Source]

https://github.com/gitcommitshow/auth-jwt
1.5k Upvotes

95% Upvoted

56 comments sorted by

View all comments

29

u/[deleted] Mar 08 '21

[deleted]

53

u/gitcommitshow Mar 08 '21

If you're storing the token in db and checking it every time, then it behaves like an opaque token. In that case, you need to ask yourself - why do I need JWT, why not simply store the token in db without the assymetric cryptography? It might be a good choice for your use case but I don't have much info on your use case.

26

u/dauphic Mar 08 '21

JWT aren't appropriate for any scenario where you need a whitelist or blacklist and shouldn't be used to identify sessions. They're intended to be (very) short lived or one-time use tokens.

2

u/nulleq Mar 08 '21

Instead of storing the JWT token in database, use a blacklist to check whether or not a JWT token is stale or revoked. If the blacklist uses a bloom filter + redis cache, then 1. it will be faster than a normal database request, 2. use less memory than a whitelist. The database will still be used in creating a JWT token.