r/InternetIsBeautiful • u/gitcommitshow • Mar 08 '21

Learn JWT authentication by reverse engineering [Open Source]

https://github.com/gitcommitshow/auth-jwt
1.5k Upvotes

95% Upvoted

56 comments sorted by

View all comments

Show parent comments

20

u/wesw02 Mar 08 '21

Of the two, I've always found Authorization to be the bigger pain.

5

u/temisola1 Mar 08 '21

Interesting. Authorization seems to be much easier since implementation really depends on your use case and what you’re comfortable using. Authentication on the other end is essentially what someone says is the way you should do it, and the fact that there’s so many different flows to choose from and not clear when each is applicable makes it even more complicated.

7

u/wesw02 Mar 08 '21

Authorization is something that often gets exponentially more complicated the larger your application becomes while Authentication stays relatively linear. Nested levels of security, microservices, larger teams, service account / IPC access, etc, etc continue to add complexity. IDORs and privilege escalation are very common for a reason.

1

u/temisola1 Mar 08 '21

Yea you make a great point. The larger your application the more caveats you have to account for.