Stop Using JWTs (gist.github.com)

Article summary

The article argues that JSON Web Tokens (JWTs) should not be used for keeping users logged in, as they are not designed for this purpose and have security issues. Instead, regular cookie sessions are recommended. The article also discusses the limitations and potential problems of using JWTs for authentication. It suggests using PASETO, a more secure alternative, for short-lived tokens.

Main themes

• JWT security issues
• Authentication methods
• Cookie sessions
• PASETO alternative
• Stateless authentication
• Session management

What commenters say

• JWTs are insecure and should not be used for user sessions due to their design limitations and potential for abuse.
• The use of JWTs for authentication is often misguided and can be replaced with more secure and traditional methods like cookie sessions.
• Some argue that JWTs can be used securely if implemented correctly, but others counter that the risks and complexity outweigh any potential benefits.
• The security of JWTs is not the only concern, as their use can also lead to scalability and maintenance issues in large-scale applications.
• There are cases where JWTs can be useful, such as in service-to-service communication, but their use in user authentication is generally discouraged.
• The choice of authentication method depends on the specific use case and requirements, and JWTs may not always be the best option.
• Some commenters argue that the problems with JWTs can be mitigated with proper implementation and security measures, while others believe that the risks are inherent to the technology.
• The use of opaque random strings as API keys is recommended as a more secure alternative to JWTs in many cases.