Should I use JWTs for authentication tokens? (blog.ploetzli.ch)

Article summary

The article argues that JSON Web Tokens (JWTs) are not necessary for most applications, as they are designed for large-scale environments like Google and Facebook. For smaller applications, using a normal session mechanism is sufficient and can be more efficient. The article also discusses the limitations and potential drawbacks of using JWTs, such as the need for a secure signing key and the complexity of handling token revocation. The author suggests that using a standard session mechanism can be a simpler and more effective solution.

Main themes

• JWTs and authentication
• Session management
• Security and scalability
• Token-based authentication
• OAuth and OpenID Connect

What commenters say

• JWTs are not necessary for most applications and can be replaced with a standard session mechanism.
• Using JWTs can be insecure if not implemented properly, and alternative solutions like PASETO may be more secure.
• Auth0 and other authentication services can handle the complexity of JWTs and other authentication protocols, making them a viable option for large-scale applications.
• Implementing SAML and other enterprise federated login mechanisms can be complex and time-consuming, making Auth0 a more attractive option for some developers.
• JWTs are a standard and widely-adopted solution for authentication, and their use can simplify development and reduce the risk of errors.
• Using a normal session mechanism can be more efficient and simpler than using JWTs, especially for smaller applications.
• The use of JWTs is not inherently bad, but rather it depends on the specific use case and implementation.
• Offloading authentication to a service like Auth0 can be a good option for many applications, as it allows developers to focus on other aspects of their project.