JWTs And Why They Suck
summary
JWTs often break guarantees developers expect: they are stateless = unrevokeable so compromised sessions cannot be revoked without server-side tracking, short expiries only partly help, and many libraries mishandle JSON edge cases. The spec’s flexibility causes algorithm confusion (none, alg header swaps, kid injection) and other footguns, and storing tokens in localStorage trades CSRF for XSS. Practical fix is simple: issue opaque random session IDs in cookies, validate server-side, or if forced to use JWTs, strictly pin algorithms and key sources.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker background
- 1:26What is a JWT and why it sucks
- 3:51Problem 1: No token revocation
- 4:54Problem 2: JSON format issues
- 5:56Problem 3: Unnecessary complexity
- 6:39Problem 4: Too many algorithms
- 8:04Problem 5: Foot guns in JWTs
- 9:50Better alternatives to JWTs
- 12:15Summary and conclusion
- 13:11Q&A and references
