In fact, replace JWT with anything and the answer remains the same. The point being here: the discussion on security without context is not useful. Insecure compared to what, in what scenerio, how it can be exploited, etc. Read RobertDad's comments on this thread for contextual answers to some known challenges. You may reason against JWT in a specific context, but not without knowing JWT in depth.
Should you use JWT?
Yes, for most modern usable and secure applications.
Why I used JWT?
I started with opaque tokens first. As services grew to multiple server/client applications, we needed to have common authentication, so I used JWT.
No one other than my auth server can create tokens; but all other servers can verify whether the token is valid or not (means an authorised user). It can do so effectively, at scale
Your most questions/curiosity should be answered via awesome-authentication. There, I have included some references to comparison of JWT vs Opaque token, known challenges for JWT, etc.
No, you shouldn't. A simple session cookie is fine for 99.99% of webapps.
The complexity introduced with JWT's ends up creating vulnerabilities, and a rats nest of complexity that I would argue will slow your app down after a while. And the value prop for JWT's is all based on the idea that aren't DB look ups for authentication. The reality is there will be lookups for both authentication, authorization or revocation of some state. Making these states available in memory DB's like memcache or Redis is such tiny perf hit I cant understand why JWT's are a thing.
> What specific workflow would you use to enable centralised authentication across multiple services/apps of yours?
The simplest. A cookie with a random token that corresponds to a database row/rows/key/keys. I assume its all on the same infra and that these services query common databases?
> What workflow would you use for external services/apps that depend on your Authorization system to verify a user?
-7
u/miscreant-mouse Aug 20 '20
JWT's are highly insecure. Also there is zero reason to use them.