Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What's wrong with using JWTs? What you have done should be industry standard and is enabled by the JWK spec. In fact several features of OpenID Connect are built upon signed JWTs from a well-known JWK store.


https://www.howmanydayssinceajwtalgnonevuln.com/

Having such a tempting footgun is a real problem.


The problem I think is that JWT is just a small puzzle piece of a great artwork that is identity and auth. It is overly complex (not without reason) and people don't put in enough effort to learn the whole picture (and it just isn't thought in schools) and just want to use something quickly for their current problem. Which is why they pick JWT and don't understand the host of related technologies - OAuth2, OIDC, JWK, JWE - just to name a few.

I don't see a reason why I would ever want to use auth=none for anything as at that point JWT is just base64 encoded json but I may be too deep in the identity world by now.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: