Re: JWT (was: Upcoming Spring 2021 RPG enhancements)

Those are also some good reading...

In fact, from the IBM i point of view, we don't use JWTs for sessions. Our
application uses ProfoundUI, which has everything needed to handle state
built in.

We do however want to use them for Federated SSO.

We also want to use them for API security

Both of which are very good fits for JWT.

Charles



On Wed, Apr 21, 2021 at 8:59 AM John Yeung <gallium.arsenide@xxxxxxxxx>
wrote:

Charles Wilt wrote:

Useful reading (this is part 2, can skip part 1 if you have a basic
understanding of JWT and user sessions)

https://supertokens.io/blog/the-best-way-to-securely-manage-user-sessions

On Wed, Apr 21, 2021 at 5:23 AM Tim Fathers <tim@xxxxxxxxxxxxx> wrote:

To be honest, I feel the post [above] actually makes my point rather

better that I have been able to - I mean talk about over engineered! It
literally says it's non-trivial to implement a token refresh mechanism,
which is mostly only there because stateless tokens can't be revoked.

I found a bunch of other sources which corroborate Tim's position.
Perhaps the easiest to digest is this:

https://blog.logrocket.com/jwt-authentication-best-practices/

That one also links to a couple of other good ones, longer but still
quite accessible:


https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session-tokens

http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/

Note that the last one does NOT support HTTPS, which means some
browsers or browser extensions will complain that you're about to
follow an unsafe link, which is slightly ironic.

I do not have the technical knowledge to evaluate whether a
complicated scheme like that used by SuperTokens does indeed buy you
better session security compared to older, simpler, more battle-tested
schemes. It's unquestionably complex. On the plus side, SuperTokens
has already packaged up their system into something you can download
for free and host yourself. It might even work directly on IBM i with
Node.js (I have not confirmed this).

One thing stressed by almost all the articles which recommend against
JWT for sessions is that JWT is uncontroversially well-suited for
certain other uses, such as authenticating API calls.

John Y.