1.2K subscribers • 1 video on Hallway
Intermediate. Assumes working knowledge.
20K views8 years ago2 recommendations
Web developmentSecurityHTTP, REST and GraphQLWeb and application security
Randall Degges critiques the use of JSON Web Tokens for web session management and advocates for traditional session cookies.
[ Thank you to our video sponsor MongoDB: mongodb.com/community/social?jmp=sfnodemeetup? ] [ Slides: speakerdeck.com/rdegges/jwts-suck-and-are-stupid ] JSON Web Tokens (JWTs) are all the rage in the security world. They’re becoming more and more ubiquitous in web authentication libraries, and are commonly used to store a user’s identity information. In this talk Randall Degges, Head of Developer Advocacy at Okta, will take you on an extensive tour of the web authentication landscape. You’ll learn how JWTs and Sessions work, and why JWTs are the worst possible solution for solving web authentication problems. You’ll also learn the real reason behind JWTs rise to fame, and better ways to secure your websites that don’t involve misplaced hype. About Randall Degges Randall Degges leads Developer Advocacy at Okta, previously Stormpath, where he builds open source security libraries and helps make the internet a little safer. In a prior life, Randall was the CTO of OpenCNAM, the largest Caller ID API service. In his free time, Randall geeks out on web best practices, explores new technologies, and spends an inordinate amount of time writing Python, Node, and Go projects. As a fun fact, Randall runs ipify.org, one of the largest IP lookup APIs which serves over 27 billion requests per month. He writes at rdegges.com, and tweets as @rdegges.What people say. Recommended as an engaging and informative talk on the pitfalls of using JWTs for session authentication.
u/webdevvermanin r/node • Recommends
On “The practical guide for Building REST API in Nodejs and MongoDB include Passport and JWT”
u/MartialSin r/node • Recommends
On “Which to choose JWT or Session Authentication?”