Skip to content
Hallway
0:00 / 0:00

#jwt#authentication#security

JSON Web Tokens Suck - Randall Degges (DevNet Create 2018)

Cisco DevNet

40K subscribers • 1 video on Hallway

YouTube
  • Recommended by 2 people: 2 in engineering communities.
  • Presented by Randall Degges
  • May be out of date. Uploaded 8 years ago, in an area where tools change fast.
  • An opinion. It argues one side of a question engineers disagree on.

Intermediate. Assumes working knowledge.

9.7K views8 years ago2 recommendations

SecurityWeb developmentWeb and application securityHTTP, REST and GraphQL

Randall Degges explains the security and architectural pitfalls of using JSON Web Tokens for session management.

JSON Web Tokens (JWTs) are all the rage in the security world. They're becoming more and more ubiquitous in web authentication libraries, and are commonly used to store a user's identity information. In this talk, you'll learn why JWTs suck, and why you should never use them.

Why it's here

2 people recommend this

What people say. Recommended as an entertaining and opinionated critique of using JWTs for session management.

u/senkoin r/node • Recommends

On “Why authorization with jwt is popular?”

One more (opinionated and funny) take in why not to use JWTs: link to this video FWIW the speaker in that video works/worked at two companies that provided auth, so he's not just some random dude. My own take is JWTs are essentially an attempt at performance optimization via client-side caching with all that entails, and are unnecessary complication for a vast majority of cases. However they do seem to have been hyped to oblivion and most of node auth tutorials I see recommend them as the "serious" options, probably parroting each other.
2View on Reddit

u/nudelholz1in r/node • Recommends

On “How do I secure my api?”

link to this video
-2View on Reddit

u/Lunchboxsushiin r/programming • Mentions

On “Pure JWT Authentication - Spring Boot 3.4.x”

I hear you, the underlying call structure stays the same though.  What benefit do you get over a traditional session or api-key (mobile).  link to this video has an awesome discussion on the architecture behind it.  I'm all for using JWTs in the right context!
1View on Reddit