Stop Using JWTs
Summary
An opinion piece arguing against the use of JSON Web Tokens (JWTs) for authentication and session management, citing security and design concerns.
Similar Articles
What's the best way to do authentication in modern applications
The article discusses the security implications of storing authentication tokens in localStorage versus cookies, emphasizing the risks of XSS attacks and the benefits of using httpOnly cookies for sensitive apps.
@svpino: Back in 2010, we could get away with SSH keys and API tokens in .env files. We can't do that anymore. I went down a rab…
The post argues that static credentials like SSH keys and API tokens are no longer sufficient, and identity-based access is a better alternative.
Preventing token theft
The article discusses the problem of authentication token theft by infostealer malware and explores a 15-year-old proposal by Dirk Balfanz to use self-signed client certificates for TLS mutual authentication to bind tokens to a specific device, preventing token reuse even if stolen.
Why We Don't Trust the Database with Authentication
This article explains the dangers of trusting the database as the sole source of truth for API authentication, using a SQL injection scenario, and presents Sturdy Statistics' approach of using HMAC-SHA512 with a cryptographic pepper for defense in depth.
SAML: A Fractal of Bad Design
The article critiques the SAML authentication protocol for its design flaws and complexity, advocating for its deprecation in favor of modern alternatives like OpenID Connect.