Submission timeline
2007–2026One slot for every year since HN launched. Height is that year's peak points; orange marks a 100+ point or 50+ comment breakout. Select a bar to open its strongest thread.
First comments on top threads
HN comment orderI've read several articles along these lines now I tend to think the arguments are pretty weak. In this media rich age, the data size argument is a bit silly. The "you're going to hit the database anyway" argument whilst probably accurate in most cases, doesn't invalidate that JWT allows for one or more fewer database hits on every request. Having built-in integrity checking is definitely a feature. Just because you can do it without JWT doesn't mean that it's…
Yes for basic websites simple DB based session might be enough. And if you think about these sessions they are essentially opaque and stateful tokens pointing to a row in DB containing the information you need. But saying JWT sucks in plain generic terms is out of context statement, in large micro-service environment if every front-end service starts hitting an identity service the fan out is gonna kill you! You keep a basic set of information in token that is…
The first top-level comment from each of the four biggest threads, in HN’s own order. Excerpts are shortened; open a comment for full context.
- Breakout years
- 2
- Total points
- 267
- Total comments
- 235
100+ points or 50+ comments
reference only — not used in Hall rules or ranking
reference only — not used in Hall rules or ranking
Every submission
| Date | Title as submitted | By | Points | Comments |
|---|---|---|---|---|
| 2017-08-18 | Why JWTs Suck as Session Tokens | rdegges | 3 | 0 |
| 2018-08-30 | Why JWTs Suck as Session Tokens (2017)First breakout · Best thread | enz | 173 | 151 |
| 2022-10-03 | Why JWTs Suck as Session Tokens (2017)Latest 20+ point return | powvans | 91 | 84 |