<story><title>Web Authentication Methods Compared</title><url>https://testdriven.io/blog/web-authentication-methods/</url></story><parent_chain></parent_chain><comment><author>groundthrower</author><text>Used jwt for our web app before - changed to session cookies. To make jwt secure for web apps it feels like you are reinventing session authentication.</text></comment>
<story><title>Web Authentication Methods Compared</title><url>https://testdriven.io/blog/web-authentication-methods/</url></story><parent_chain></parent_chain><comment><author>franky47</author><text>Another interesting method, overkill for most applications but absolutely required for end-to-end encrypted apps where no password must be sent to the server (eg: password managers): the Secure Remote Password (SRP) protocol[1].&lt;p&gt;It&amp;#x27;s a form of zero-knowledge proof-based verification that the password provided during account creation matches the one provided during an authentication challenge, all without transmitting the password at all. As a bonus, it also act as a key exchange on the client and server, that can be used for securing transmissions over untrusted channels (at the cost of having stateful connections).&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Secure_Remote_Password_protocol&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Secure_Remote_Password_protoco...&lt;/a&gt;</text></comment>