Thanks for posting those, I finally got round to reading them, needless to say, I agree 😉
________________________________
From: RPG400-L <rpg400-l-bounces@xxxxxxxxxxxxxxxxxx> on behalf of John Yeung <gallium.arsenide@xxxxxxxxx>
Sent: 21 April 2021 15:59
To: RPG programming on IBM i <rpg400-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: JWT (was: Upcoming Spring 2021 RPG enhancements)
Charles Wilt wrote:
Useful reading (this is part 2, can skip part 1 if you have a basic
understanding of JWT and user sessions)
https://supertokens.io/blog/the-best-way-to-securely-manage-user-sessions
On Wed, Apr 21, 2021 at 5:23 AM Tim Fathers <tim@xxxxxxxxxxxxx> wrote:
To be honest, I feel the post [above] actually makes my point rather better that I have been able to - I mean talk about over engineered! It literally says it's non-trivial to implement a token refresh mechanism, which is mostly only there because stateless tokens can't be revoked.
I found a bunch of other sources which corroborate Tim's position.
Perhaps the easiest to digest is this:
https://blog.logrocket.com/jwt-authentication-best-practices/
That one also links to a couple of other good ones, longer but still
quite accessible:
https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session-tokens
http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/
Note that the last one does NOT support HTTPS, which means some
browsers or browser extensions will complain that you're about to
follow an unsafe link, which is slightly ironic.
I do not have the technical knowledge to evaluate whether a
complicated scheme like that used by SuperTokens does indeed buy you
better session security compared to older, simpler, more battle-tested
schemes. It's unquestionably complex. On the plus side, SuperTokens
has already packaged up their system into something you can download
for free and host yourself. It might even work directly on IBM i with
Node.js (I have not confirmed this).
One thing stressed by almost all the articles which recommend against
JWT for sessions is that JWT is uncontroversially well-suited for
certain other uses, such as authenticating API calls.
John Y.
--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at
https://archive.midrange.com/rpg400-l.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com
midrange.com
