Andrei Listochkin (Андрей Листочкин) listochkin

Stop using JWTs!

TLDR: JWTs should not be used for keeping your user logged in. They are not designed for this purpose, they are not secure, and there is a much better tool which is designed for it: regular cookie sessions.

If you've got a bit of time to watch a presentation on it, I highly recommend this talk: https://www.youtube.com/watch?v=pYeekwv3vC4 (Note that other topics are largely skimmed over, such as CSRF protection. You should learn about other topics from other sources. Also note that "valid" usecases for JWTs at the end of the video can also be easily handled by other, better, and more secure tools. Specifically, PASETO.)

A related topic: Don't use localStorage (or sessionStorage) for authentication credentials, including JWT tokens: https://www.rdegges.com/2018/please-stop-using-local-storage/

The reason to avoid JWTs comes down to a couple different points:

The JWT specification is specifically designed only for very short-live tokens (~5 minute or less). Sessions

While a lot of Node.js guides recommend using JWT as an alternative to session cookies (sometimes even mistakenly calling it "more secure than cookies"), this is a terrible idea. JWTs are absolutely not a secure way to deal with user authentication/sessions, and this article goes into more detail about that.

Secure user authentication requires the use of session cookies.

Cookies are small key/value pairs that are usually sent by a server, and stored on the client (often a browser). The client then sends this key/value pair back with every request, in a HTTP header. This way, unique clients can be identified between requests, and client-side settings can be stored and used by the server.

Session cookies are cookies containing a unique session ID that is generated by the server. This session ID is used by the server to identify the client whenever it makes a request, and to associate session data with that request.

*S

This serves as a base canary gist for @rwjblue.

A few useful links for the main source/gist are:

My summary of https://www.youtube.com/watch?v=IqrwPVtSHZI

TL;DR:

Rails has a library, ActiveSupport, which adds methods to Ruby core classes. One of those methods is String#blank?, which returns a boolean (sometimes I miss this convention in Rust, the ?) if the whole string is whitespace or not. It looks like this: https://github.com/rails/rails/blob/b3eac823006eb6a346f88793aabef28a6d4f928c/activesupport/lib/active_support/core_ext/object/blank.rb#L99-L117

It's pretty slow. So Discourse (which you may know from {users,internals}.rust-lang.org) uses the fast_blank gem, which provides this method via a C implementation instead. It looks like this: https://github.com/SamSaffron/fast_blank/blob/master/ext/fast_blank/fast_blank.c

For fun, Yehuda tried to re-write fast_blank in Rust. Which looks like this:

Name	Price	Integrations	Limits	Language
bugsnag.com	$29 per month	slack, jira	5 devs	javascript, php
speedcurve.com	$0.01 per check	slack, jira	-	javascript
honeybadger.io	$44 per month	slack, jira	5 projects	javascript
atatus.com	$29 per month	slack, jira	200000 view/month	javascript
muscula.com	$14 per month	-	1 000 000 errors/month	javascript
exceptional.io	-	-

	# rails new app_name -d mysql --skip-bundle -m path/to/this/template.rb

	comment_lines 'Gemfile', "gem 'turbolinks'"
	comment_lines 'Gemfile', "gem 'jbuilder'"
	comment_lines 'Gemfile', "gem 'sass-rails'"
	comment_lines 'Gemfile', "gem 'coffee-rails'"
	comment_lines 'Gemfile', "gem 'uglifier'"
	comment_lines 'Gemfile', "gem 'sdoc'"

	gsub_file 'Gemfile', "gem 'mysql2'", "gem 'mysql2', '~> 0.3.20'"

	# Save this file to ~/.multirust/Makefile
	# to run, cd ~/.multirust; make toolchains/1.3.0/src
	.PHONY: clean

	rust.git:
	git clone https://github.com/rust-lang/rust.git --bare

	toolchains/nightly/src: toolchains/master/src
	ln -sf $$(pwd)/toolchains/master/src $$(pwd)/$@

	import Ember from 'ember';
	import StartExamMixin from '../../../mixins/start-exam';
	import { module, test } from 'qunit';
	import sinon from 'sinon';

	const {
	RSVP,
	ActionHandler
	} = Ember;


	Thank you for extending an invitation to speak at HighLoad++. I
	sincerely appreciate your consideration.

	I am an outspoken advocate for LGBTQ equality; this position is deeply
	woven into my work. Clojure From The Ground Up is adamantly
	LGBT-inclusive. Jepsen is named after a gay pop anthem and includes
	dozens of references to same-sex relationships and trans identities. My
	talk slides are populated with bearded nuns, genderqueer punks, and
	trans hackers. My twitter feed is about as gay as it is possible to get.