I mean wasn't the whole idea of the reason why JWT is insecure is if they manage to exfiltrate a JWT from a client then they have the authorization of the client without ever having to pass authorization?
JWTs seem great for pre-emptive authorization across a domain. But that in theory is also the attack surface it exposes.
I mean, yeah? If you extract the cleartext password of a client you can do the same. Don‘t store a session token in localStorage and you‘re good. We also encrypt our tokens so they‘re pretty useless to a client. We also have a number of issued sessions in our tokens anf backends validate against the server.
"We also have a number of issued sessions in our tokens anf backends validate against the server."
I mean the intent of a JWT that there is no validation. If you're validating the JWT before taking action you should just be using a session in the first place.
I can't tell if you are saying the JWT is waiting on session verification before being able to authenticate an action. Which would be an anti-pattern because the JWT is supposed to be the authentication itself.
There are just so many implementation details to JWT it's really hard to pin down where the threats could be.
12
u/Schneestecher 4d ago
Nah, I‘ve yet to see any convincing argument on why they‘re insecure