Portable Sessions with JSON Web Tokens

on YouTube ↗32m

" summary

Shows JWTs replacing cookies and opaque API tokens by sending one token, two headers so a single signed payload carries the user id, expiry and metadata and the server verifies a signature instead of querying the DB on every request. Demonstrates RSA public keys and JSON Web Keys to avoid secret sharing, uses a scope claim plus an optimistic lock for password‑reset and email login, recommends short lived access tokens with refresh tokens, key ids and epoched rotation, and a blacklist for immediate revocation.

AI-written summary · about

" chapters (13)

1. 0:00Intro
2. 0:40Meet Lance
3. 4:59Logging in
4. 8:59JSON Web Tokens
5. 12:45Recap
6. 15:12Problem 2 Facepage
7. 15:49Problem 3 Cookies
8. 16:42Problem 4 Secrets
9. 19:05Problem 5 Password Resets
10. 19:38Building a Password Reset JSON Web Token
11. 22:40Problem Number 7
12. 24:28Conclusion
13. 25:20Questions

" related talks

• 04mJSON Web TokensMartin Gontovnikas · dotJS 2014
• 38mAuthentication as a Microservice: Portable Customer Identity ManagementBrian Pontarelli · OWASP AppSec USA 2018
• 34mStateless Auth w/ JSON Web TokensDamir Svrtan · Southeast Ruby 2017
• 45mJWT - To authentication & beyond!Luís Cobucci · Laracon EU 2017
• 34mAuthenticating your single page apps using JSON Web TokensSam Bellen · apidays Singapore 2019
• 40mKnock knock, who's there? Authenticating your single page apps using JSON Web TokensSam Bellen · GrillJS 2019
• 37mKnock knock, who's there? Authenticating your single page apps using JSON Web TokensSam Bellen · Jfokus 2019
• 29mKnock knock, who's there? Authenticating your single page apps using JSON Web TokenSam Bellen · AngularDay 2019