JWTs: A secure and stateless way to implement authentication

https://medium.com/@bryanmanuele/sessionless-authentication-using-jwts-with-node-express-passport-js-69b059e4b22c

by Dirak • 8 years ago

14 6 8 years ago

Dirak• 8 years ago

This article serves as a rebuttal to http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo.... It deconstructs each criticism presented and explains why JWTs are a secure and elegant solution to authentication. It also goes over how one would go about implementing authentication securely using JWTs with Node + Express + Passport.js.

chii2• 8 years ago

The biggest criticism from the original article is that you are unable to revoke jwt individually. This was not debunked nor mentioned (unless I blind and didn't see it, in which case I apologize).

nerdwaller• 8 years ago

There’s nothing really stopping you from revoking a JWT individually - simply keep the `jti` (or any arbitrary claim) in memcached/redis/etc and check it. Obviously it’s no longer stateless and gives up some of the benefits of a JWT, but it’s a solution if revocation is a business requirement.

Like everything, there’s no silver bullet (JWT vs random string token) - business requirements dictate which makes sense.

JWTs: A secure and stateless way to implement authentication

Related Stories