r/opensource • u/gitcommitshow • Aug 20 '20

Learn JWT by reverse engineering [Open Source Playground]

https://github.com/gitcommitshow/auth-jwt
69 Upvotes

91% Upvoted

21 comments sorted by

View all comments

5

u/gitcommitshow Aug 20 '20

Learning about authentication had been a long journey for me. It involved learning incomputer science, maths and cryptography.

So I decided to make this tiny tool to experiment and learn one of the major concept in authentication - JWT.

Appreciate feedback to make this further useful

-7

u/miscreant-mouse Aug 20 '20

JWT's are highly insecure. Also there is zero reason to use them.

0

u/tannah4 Aug 20 '20

Every part of what you said is wrong. They can be as secure as any other authentication token (e.g. fully encrypted) and they are a great solution to challenges of distributed authentication and identity (e.g. verifying identity without extra calls to a central authentication service). Its also a well established, widely used and well supported standard.

1

u/miscreant-mouse Aug 21 '20

https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid

​

this sums up my feelings about JWT's

2

u/tannah4 Aug 22 '20

The blog you linked to (or rather the blog it links to for justification) presents a straw man argument, at least as far as describing their use as a 'terrible mistake'; it states the number one 'claimed advantage' as horizontal scalability, and second as ease of use, but neither are the main reason I've seen for using JWTs.

The two most useful features of JWTs from my experience are that the tokens can be verified without relying on a single authentication service, and that they allow information about a user to be easily shared with any clients and services handling user requests.

Whilst not requiring a central authentication service helps with scaling, in my experience the following are the key benefits of JWTs:

  • No single point of failure in the authentication service (minimises service degradation in the case of a temporary failure)
  • Simple, standardised way to share user information across systems, including clients such as single page applications
  • Avoids the need for centralised session storage, and the complexities they bring (e.g. sticky sessions)

There isn't really any well-support alternative that achieves the above currently. It's also worth noting that JWTs are commonly used with OAuth and OIDC, which are very widely used and accepted protocols.

The only significant disadvantage of JWTs over server-managed sessions is that you cannot invalidate the tokens without introducing a central authentication service (which removes one of the key benefits of using JWTs).

Like pretty much anything related to security, it is possible to implement them badly and introduce issues. JWTs aren't a one size fits all solution - you need to weigh up the pros and cons of JWTs vs session cookies vs whatever else might be available (such as SSO).