u/rdeggesin r/node • Recommends
On “JWT logout using blacklist method”
Yes: link to this video
0:00 / 0:00
- Recommended by 3 people: 3 in engineering communities.
- Presented by Randall Degges, Head of Developer Advocacy at Okta
- May be out of date. Uploaded 8 years ago, in an area where tools change fast.
- An opinion. It argues one side of a question engineers disagree on.
Intermediate. Assumes working knowledge.
17K views8 years ago3 recommendations
Web developmentSecurityHTTP, REST and GraphQLWeb and application security
Randall Degges explains why JSON Web Tokens are a poor choice for web session authentication and compares them to traditional cookie-based sessions.
By Randall Degges Speaker Abstract: JSON Web Tokens (JWTs) are all the rage in the security world. They’re becoming more and more ubiquitous in web authentication libraries, and are commonly used to store a user’s identity information. In this talk Randall Degges, Head of Developer Advocacy at Okta, will take you on an extensive tour of the web authentication landscape. You’ll learn how JWTs and Sessions work, and why JWTs are the worst possible solution for solving web authentication problems. You’ll also learn the real reason behind JWTs rise to fame, and better ways to secure your websites that don’t involve misplaced hype. Delivered at ForwardJS January 13th, 2018 San Francisco, CA forwardjs.comWhy it's here
3 people recommend thisWhat people say. Recommended as a compelling argument against using JSON Web Tokens for session management.
u/eslachancein r/node • Recommends
On “Stop using JWT for sessions”
….
I'm not the one saying it. Randal Degges is, and he's behind the biggest part of the campaign to popularize JWTs as an alternative to cookies for ephemeral communication, but it was misunderstood as a replacement for cookies. The company he worked for at the time, Auth0, was just glad for the publicity stunt they inadvertently caused.
Source: link to this video…