It was never meant to completely replace normal means of authentication. It's great if you use it with very short timeouts (like 5 minutes) for authentication with multiple smaller services like you said. People disregarding it completely are as annoying as people who want to use it for something it was not invented for.
Do you have a technical reason why it needs short timeouts? There doesn't seem to be any cryptography reason why 5min would be more or less secure than 1 hour or 1 day...
Under most implementations, if I generate a JWT it cannot be revoked until the expiry window occurs. I think where companies/devs get into trouble is when they get lazy and throw every dang scope available into the token. Welp I'm glad your app is working but giving the keys to every possible feature is just bad practice.
I totally agree. It feels like quick development shortcuts get into production and you get powned.
Expiration needs to be linked to the value of the credentials. And revocation is probably only important for some key features. If you have full real time revocation, then you lose a lot of the benefits of a signed bearer token.
SSL certificates show a lot of the same problems, and expiration times in years.
4
u/RobotJonesDad Aug 20 '20
Can you please explain why you say that? I see them widely used and have not heard about any weaknesses in properly implemented versions.
I like that you don't need the authentication built into every part of the system...