#jwt on Hacker News

3 stories tagged jwt, newest first.

Screenshot of blog.faav.net: I could've accessed 17T Microsoft records

I could've accessed 17T Microsoft records (blog.faav.net)

287 points by luispa 27 days ago | 120 comments

A security researcher's blog post describing a Microsoft internal analytics service flaw where unchecked token signatures allowed admin access to query 17.3 trillion records.

microsoft bug-bounty authentication-bypass jwt

Screenshot of gist.github.com: Stop Using JWTs

Stop Using JWTs (gist.github.com)

455 points by dzonga 4 months ago | 265 comments

A GitHub Gist arguing that JWTs should not be used for keeping users logged in and that regular cookie sessions are a better, more secure choice.

jwt authentication session-cookies web-security

Screenshot of blog.ploetzli.ch: Should I use JWTs for authentication tokens?

Should I use JWTs for authentication tokens?(blog.ploetzli.ch)

536 points by pantalaimon 2 years ago | 367 comments

Blog essay by Henryk Plötz arguing that JSON Web Tokens should not be used as authentication/session tokens, explaining the reasons.

jwt authentication session-tokens web-security

#jwt on Hacker News

I could've accessed 17T Microsoft records(blog.faav.net)

Stop Using JWTs(gist.github.com)

Should I use JWTs for authentication tokens?(blog.ploetzli.ch)

I could've accessed 17T Microsoft records (blog.faav.net)

Stop Using JWTs (gist.github.com)