Stop using JWT for sessions (2016)

Top reason for me always was : > You cannot invalidate individual JWT tokens And there are more security problems. Unlike sessions - which can be invalidated by the server whenever it feels like it - individual stateless JWT tokens cannot be invalidated. By design, they will be valid until they expire, no matter what happens. This means that you cannot, for example, invalidate the session of an attacker after detecting a compromise. You also cannot invalidate old sessions when…

You cannot invalidate JWT tokens This is simple not true. You ALWAYS will sign your tokens with a well known secret, you could eventually even add some salt from a database to it. They are less secure Compared to what? Actually JWT will have the same secureness like Bearer Tokens or Cookies, wherever you store it, its not `less` secure. Horrible article points here. They are less secure They take the same amount of storage than signed cookies, wuhu I…

Terrible, Terrible advice. Here's an actual quote from the article: "...unless you are operating at the size of Reddit, you will not need 'stateless sessions'." So for the rest of 99% of the technology world, you don't need stateless session because TFA says so.

Eh, disagree. For space, you can use ellipic curve instead of RSA to halve the size of your token. Sticky sessions are really hard or impossible on public clouds where you can't load balance by ip/port hash. And still hard when you consider that mobile devices hop on and off wifi constantly. One of the worst, shittiest third parties we use has IP based sticky sessions and it's utterly broken because we run 3 instances in different AZ's for HA…