<story><title>Why JWTs Suck as Session Tokens (2017)</title><url>https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session-tokens</url></story><parent_chain><item><author>AndrewSChapman</author><text>I&amp;#x27;ve read several articles along these lines now I tend to think the arguments are pretty weak.&lt;p&gt;In this media rich age, the data size argument is a bit silly.&lt;p&gt;The &amp;quot;you&amp;#x27;re going to hit the database anyway&amp;quot; argument whilst probably accurate in most cases, doesn&amp;#x27;t invalidate that JWT allows for one or more fewer database hits on &lt;i&gt;every&lt;/i&gt; request.&lt;p&gt;Having built-in integrity checking is definitely a feature.  Just because you can do it without JWT doesn&amp;#x27;t mean that it&amp;#x27;s not useful that JWT does it.&lt;p&gt;IMHO the biggest argument against the use of JWT is that you can&amp;#x27;t easily invalidate JWT sessions.  Should you need to dump a users session or if the information contained in that session token has become invalid then you might be in trouble.  For my use cases so far however this hasn&amp;#x27;t been a problem.&lt;p&gt;JWT is a fine solution for quite a lot of use cases.  As with everything tech, just be aware of the limitations and choose wisely.</text></item></parent_chain><comment><author>CiPHPerCoder</author><text>I&amp;#x27;ve been fond of [1] and [2] for a more focused argument against JWT for sessions.&lt;p&gt;The JOSE standards (of which JWT is a member) are error-prone and have had numerous critical security-affecting bugs due to how they were designed. [3]&lt;p&gt;To remedy that, I proposed PASETO. [4]&lt;p&gt;I still don&amp;#x27;t recommend PASETO for sessions, because of the arguments laid out in [1] and [2].&lt;p&gt;[1] &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;cryto.net&amp;#x2F;~joepie91&amp;#x2F;blog&amp;#x2F;2016&amp;#x2F;06&amp;#x2F;13&amp;#x2F;stop-using-jwt-for-sessions&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;cryto.net&amp;#x2F;~joepie91&amp;#x2F;blog&amp;#x2F;2016&amp;#x2F;06&amp;#x2F;13&amp;#x2F;stop-using-jwt-fo...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;cryto.net&amp;#x2F;%7Ejoepie91&amp;#x2F;blog&amp;#x2F;2016&amp;#x2F;06&amp;#x2F;19&amp;#x2F;stop-using-jwt-for-sessions-part-2-why-your-solution-doesnt-work&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;cryto.net&amp;#x2F;%7Ejoepie91&amp;#x2F;blog&amp;#x2F;2016&amp;#x2F;06&amp;#x2F;19&amp;#x2F;stop-using-jwt-...&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;paragonie.com&amp;#x2F;blog&amp;#x2F;2017&amp;#x2F;03&amp;#x2F;jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;paragonie.com&amp;#x2F;blog&amp;#x2F;2017&amp;#x2F;03&amp;#x2F;jwt-json-web-tokens-is-ba...&lt;/a&gt;&lt;p&gt;[4] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;paseto.io&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;paseto.io&lt;/a&gt;</text></comment>
<story><title>Why JWTs Suck as Session Tokens (2017)</title><url>https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session-tokens</url></story><parent_chain><item><author>AndrewSChapman</author><text>I&amp;#x27;ve read several articles along these lines now I tend to think the arguments are pretty weak.&lt;p&gt;In this media rich age, the data size argument is a bit silly.&lt;p&gt;The &amp;quot;you&amp;#x27;re going to hit the database anyway&amp;quot; argument whilst probably accurate in most cases, doesn&amp;#x27;t invalidate that JWT allows for one or more fewer database hits on &lt;i&gt;every&lt;/i&gt; request.&lt;p&gt;Having built-in integrity checking is definitely a feature.  Just because you can do it without JWT doesn&amp;#x27;t mean that it&amp;#x27;s not useful that JWT does it.&lt;p&gt;IMHO the biggest argument against the use of JWT is that you can&amp;#x27;t easily invalidate JWT sessions.  Should you need to dump a users session or if the information contained in that session token has become invalid then you might be in trouble.  For my use cases so far however this hasn&amp;#x27;t been a problem.&lt;p&gt;JWT is a fine solution for quite a lot of use cases.  As with everything tech, just be aware of the limitations and choose wisely.</text></item></parent_chain><comment><author>kodablah</author><text>I concur with the author about session usage of JWT since it has little value (and if you did, just use it for it&amp;#x27;s signing feature and still have it just contain a random session identifier). The reasons for defending it in that use seem to be about what&amp;#x27;s not bad, but rarely about what&amp;#x27;s good.&lt;p&gt;But JWTs have value for API tokens as they can embed an expiration date for the caller in a known format. But the idea of stateless JWTs with a bunch of valid data for use on successive calls by the server is a bit much. You should contact your auth store of record per invocation for various reasons.&lt;p&gt;Like you said, be aware of the issues with chosen sig algorithms and be exact on what you choose and just leverage JWT as the format, not blindly following the generation libraries without investigation.</text></comment>