Skip to content
Hallway
0:00 / 0:00

#jwt#authentication#stateless

100% Stateless with JWT (JSON Web Token) by Hubert Sablonnière

Devoxx

172K subscribers • 63 videos on Hallway • Conference channel

YouTube
  • Recommended by 3 people: 3 in engineering communities.
  • A classic. People kept recommending it from 2019 to 2024.
  • Presented by Hubert Sablonnière
  • May be out of date. Uploaded 9 years ago, in an area where tools change fast.

Intermediate. Assumes working knowledge.

122K views9 years ago3 recommendations

SecurityWeb developmentCryptographyHTTP, REST and GraphQL

Hubert Sablonnière explains the inner workings, benefits, and drawbacks of using JSON Web Tokens for stateless authentication.

Please subscribe to our YouTube channel @ bit.ly/devoxx-youtube Like us on Facebook @ facebook.com/devoxxcom Follow us on Twitter @ twitter.com/devoxx In our modern REST architectures, the session cookies of old are getting stale and crusty. It’s time to unbox JSON Web Tokens : a new approach, simpler, 100% stateless and easily scalable. No more server side session storage. No more session replication across the cluster. Best of all, navigating multiple layers of APIs with only a single connection is much easier. In this talk, you will discover the inner workings of JWTs. You will see how to handle a client session properly between a browser and a server. We will explore other usages and wrap up with pros and cons. Hubert Sablonnière I'm a curious and passionnate Web developer. I'm specialized in HTML, CSS and JavaScript but I also use server side technologies like NodeJS, PHP, Java, Neo4j, Docker... With OpenDevise I help clients to move their trainings and conference talks to the next level. My motivation : "To push the technology far enough to find new ways to improve user's experiences." [DUK-7522]

Why it's here

3 people recommend this

What people say. Recommended as an in-depth explanation of JWTs, session management, and secure token storage.

Moments people linked to

u/Transcender49in r/dotnet • Recommends

On “Help implement auth”

I don't have any experience with casbin but I did session id based and token based auth using ASP.NET Identity. the resources are mainly: The docs ofc link to this video link to this video link to this video https://auth0.com/blog/how-to-validate-jwt-dotnet/ https://www.infoworld.com/article/3669188/how-to-implement-jwt-authentication-in-aspnet-core-6.html https://wildermuth.com/2018/04/10/Using-JwtBearer-Authentication-in-an-API-only-ASP-NET-Core-Project/ for the xss, sql injection and csrf attacks mentioned in these resources check out this channel link to this video
8View on Reddit

u/MennaanBaarinin r/node • Recommends

On “Tired of all the express/jwt medium articles. Here's a repo”

There is this talk which go a bit more in depth and answers some of your questions: link to this video
3View on Reddit

u/wradgioin r/node • Recommends

On “Advice for adding authentication/authorization to a Node.js App”

Use JWT, there are a lot of resources - I can add another two: 1. [video 2. https://medium.com/lightrail/getting-token-authentication-right-in-a-stateless-single-page-application-57d0c6474e3 TLTR - store JWT in a cookie, that is secured & httpOnly. Javascript in the browser should **NEVER** be able to read JWT cookie with sensitive data. The browser should always just send that cookie back to the backend with action and the backend should do the verification. If you need for example user data, send them in response, do not store them in JWT. JWT itself is just a way to convert an object into a string that is easy to store and verify. It does not protect the content, it can be easily c…
1View on Reddit

u/Uuuhyggeligin r/programming • Mentions

On “OAuth 2.1 is Here: What You Need to Know”

Just spent a good while trying to find them ... Man, Youtube is getting worse. I wonder if they deprioritize these long and in depth videos, because I had to scroll through an endless stream of superficial tutorials on it. No wonder people find it confusing if they good explainations are getting buried. For OAuth 2 and OIDC specifically: [video A bit long, but it explains the different flows in a straight forward manner and clears up the confussion between OAuth 2 and OIDC. For a more general talk on a stateless architecture: [video It's main focus is the difference between JWT tokens and session IDs, but he also discusses how OAuth fits into this. There is two more that I can…
20View on Reddit