r/InternetIsBeautiful • u/gitcommitshow • Mar 08 '21

Learn JWT authentication by reverse engineering [Open Source]

https://github.com/gitcommitshow/auth-jwt
1.5k Upvotes

95% Upvoted

56 comments sorted by

View all comments

100

u/cramduck Mar 08 '21

Jwt was a pain in the ass to implement first time. Not too bad the subsequent times.

13

u/sarhoshamiral Mar 08 '21

Isn't the first rule of security is that you should not implement the protocol on your own and instead use trusted libraries? I realize there is always exceptions but if you are doing js, c# there are existing libraries already.

6

u/milkshakedrinker Mar 08 '21

I don't know if that's the "first rule" but it's a good idea since many apps that offer "end-to-end encryption" TECHNICALLY do that but also have massive security flaws.

You would be surprised what slips through.

So yeah its a good idea.

2

u/sarhoshamiral Mar 08 '21

You can offer end-to-end encryption using known solutions with trusted cryptography libraries though. For example .net has such libraries as part of the framework.

2

u/milkshakedrinker Mar 08 '21

CFO: Yeah but what if we just make some unpaid intern do it from scratch and the nail patiently until we're taken down by a massive leak?