JSON Web Tokens should be avoided

The criticisms of JWT seem to fall into two categories: (1) Criticizing vulnerabilities in particular JWT libraries, as in this article. (2) Generally criticizing the practice of using any "stateless" client tokens. Because there's no great way to revoke them early while remaining stateless, etc. The problem is that both of these groups only criticize, neither of them can ever seem to actually recommend any alternatives. I could care less about JWT per se. I'm happy to implement a similar…

If you, like me, prefer HN comments over articles: The author does not just complain about JOSE and JWT but he also designed an alternative, PASETO: https://paseto.io/ Here's a nice PASETO write-up from Okta, a reputable third party: https://developer.okta.com/blog/2019/10/17/a-thorough-introd... PASETO looks excellent to me, in that it's proper developer friendly and makes it hard for non crypto nerds like me to shoot themselves in the foot. I can't wait for it to replace JWT in popularity.

We're developing a simply secure alternative, called PASETO (Platform-Agnostic Security Tokens). D. R. I. N. K. Y. O. U. R. O. V. A. L.... Hey wait a minute, this secret message is just an advertisement!