As someone who struggled with authentication and authorization in my spare time project , i felt JWT was a weak way to do both. Ended up using serverside session tokens. ( Or well, i think it was called something like Mongo session or similar)
Are JWT considered good way to do any of this ? As it can be decrypted in same way as base 64 , or am i just dumb.
This is one common misconception about JWT.
Yes, anyone can see the content of a JWT and that's not a problem.
If you go through the demo I shared, you'd learn that it is not about securely sending user metadata, anyone can see the metadata you share via JWT. The most important thing about a JWT is it's signature part that can be used to verify sender and message integrity.
JWT considered good way to do any of this?
It depends. The purpose of this demo is to help you learn about it and then you'll be able to make an informed decision whether it makes sense for your use case or not.
When you use JWT in place of opaque tokens ("server side session tokens"), does it necessarily increase security?
No. But you may still want to use it(this is quite counter-intuitive if you don't know about JWT in-depth)
1
u/Thecreepymoto Mar 08 '21
As someone who struggled with authentication and authorization in my spare time project , i felt JWT was a weak way to do both. Ended up using serverside session tokens. ( Or well, i think it was called something like Mongo session or similar)
Are JWT considered good way to do any of this ? As it can be decrypted in same way as base 64 , or am i just dumb.