Adding business logic to your tokens. What could possibly go wrong
summary
Identity tokens and access tokens carry real claims not marketing words: this system has dozens of business claims stuffed into JWTs, creates a hard coupling between identity server and API, and builds tokens up to four times per request so cookies get chunked into many headers. That triggers Kong header limit errors and huge encrypted cookies. Some clients read long-lived (14 day) access tokens causing stale or persistent access; only two of forty apps actually used the claims. Use userinfo or an API endpoint instead.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 0:40About Linda
- 3:15Lost Puppy Project
- 5:37Key Tips
- 8:12Basic Access Token
- 9:08What happened when I took over
- 9:43Picking a token
- 10:06Reading the RFC
- 11:00Token Scopes
- 12:45Creating an Identity Server
- 13:08Testing API
- 14:48What could possibly go wrong
- 15:28Application ID
- 16:42API
- 18:57Security Token Validator
- 19:58Cookies
- 20:24Max cookie size
- 21:16Cookie Chunky Manager
- 22:25Kong has limits
- 23:11Kong has a big head
- 23:31We cant get rid of them
- 24:13Kong error fix
- 24:59Removing the token
- 26:35Why was this a problem
- 28:30Two minds
- 29:03Undocumented endpoints
- 32:30Time
- 34:05Story
- 37:33Why do we have 14day access tokens
- 42:35Recap
- 43:58Love your puppy project
- 44:44Lunch
related talks
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
24mA Token Walks Into a SPA
37mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
32mTips and Tricks for JSON Web Tokens (JWTs)
25mHow JSON Web Tokens Work and Can be Used to Secure Your Single Page Apps
54mJSON Web Tokens Suck
15mJWTs And Why They Suck
29mKnock knock, who's there? Authenticating your single page apps using JSON Web Token