Skip to content
Hallway
0:00 / 0:00

#jwt#singlepageapplications#authentication

Securing Single Page Applications with Token Based Authentication (Stefan Achtsnit, BGT)

WeAreDevelopers

108K subscribers • 4 videos on Hallway

YouTube
  • Recommended by 2 people: 2 in engineering communities.
  • Presented by Stefan Achtsnit, Head of Advanced Services at BGT
  • May be out of date. Uploaded 10 years ago, in an area where tools change fast.

Intermediate. Assumes working knowledge.

11K views10 years ago2 recommendations

SecurityWeb developmentWeb and application securityHTTP, REST and GraphQL

Stefan Achtsnit outlines the security trade-offs and attack vectors of using JSON Web Tokens for authentication in Single Page Applications.

Visit the largest developers congress in Europe: WeAreDevelopers World Congress, 16 - 18 May 2018 in Vienna, Austria. wearedevelopers.com/congress/ Client-side tokens seem to be the default answer to the authentication challenge with Single Page Applications nowadays - but for questions like 'Where to store them?' or 'How to revoke them?' the answer is not that straight forward. This talk outlines attack vectors and trade-offs to make when using JSON Web Tokens to build a secure authentication solution for Single Page Applications. Stefan Achtsnit is Head of Advanced Services at Best Gaming Technology (www.best-gaming.com). Stefan guides the data driven journey at BGT. Developing software in the .NET and Java enterprise space for 12 years, he constantly strives for the right balance between being innovative and pragmatic of what is actually needed. This talk was held at the WeAreDevelopers Conference 2016 in Vienna, Austria: www.wearedevelopers.org

Why it's here

2 people recommend this

What people say. Recommended as an excellent resource for understanding the security implications of storing JWTs in single-page applications.

u/zombie_kiler_42in r/node • Recommends

On “How do I add a username/password login form for a SPA using Oauth2?”

The comment I have been writing for 15 min disappeared so instrad i will leave you with a video that I hope will shed some light into your situation. [video Edit: since you said evolve I assume it isn't now, if the evolution is going to take some time, I would suggest you don't worry about it too much, take that time to evaluate if microservices are really what can solve your problem, i find most times it adds unnecessary complexity... Occam's razor man,
2View on Reddit

u/Pedrock10in r/node • Recommends

On “What Node topics are not/poorly covered?”

JWTs are popular due to SPAs. The problem with a cookie session is that you don't have a way of knowing whether you are authenticated or not in the front-end. However, it's not a good idea to store the JWT in the localStorage either. The best resource I have seen on this topic has been this talk: link to this video I have yet to do some more research on this topic though.
1View on Reddit