That is true, but if someone intercepts a token then they can already see all the data (or perform all the actions), even before the user logs out, so this doesn't count as a flaw.
Lame. A simple blacklist would suffice.
The blacklist entries would expire after the lifetime of a generic token.
Since the blacklist is small, it could fit in server's RAM and be fast.
Or it could be stored somewhere in Redis.
> 3. Could have stale data.
> Imagine the user is an admin and got demoted to a regular user with fewer permissions.
Lame. Just block the old token on any privilige changes.
All roles are stored in a token anyway, so if a user's priviliges change, then all the user's tokens should be included in the blacklist.
> 4. JWT’s are often not encrypted so anyone able to perform a man-in-the-middle attack and sniff the JWT now has your authentication credentials.
Not even true.
There're no credentials in the token.
There's just a user ID and that's it.
> It’s been found that many libraries that implement JWT have had many security issues over the years.
And Linux kernel has had many bugs.
So what now? Not use Linux?
> In many complex real-world apps, you may need to store a ton of different information.
And storing it in the JWT tokens could exceed the allowed URL length or cookie lengths causing problems.
Lame.
No one uses cookies or URL for that.
No one stores enormous amounts of data in a JWT.
> In many real-world apps, servers have to maintain the user’s IP and track APIs for rate-limiting and IP-whitelisting.
Not a valid argument.
Those apps aren't even many, they're a very small portion.
Very small, almost zero.
> One popular solution is to store a list of “revoked tokens” in a database and check it for every call. And if the token is part of that revoked list, then block the user from taking the next action. But then now you are making that extra call to the DB to check if the token is revoked and so deceives the purpose of JWT altogether.
They aren't very smart, are they?
Because they don't even see a difference between a short in-memory list and a database full of users records.
Thanks @oseibonsu.
On March 9th, 2020, GitHub has banned my account without any notice for an unknown reason.
I found out about that only when people started sending me emails telling me that my hosted libraries have stopped working and asking me why did I delete my GitHub account (which I didn't).
Apparently, for any person other than me, when navigating to any of my libraries' page, GitHub simply displayed a "404 Not found" page. Not even a "user account suspended" page — nothing. Just as if the person didn't exist, and all their libraries too. GitHub, if you're banning someone then at least have some balls to publicly admit it.
The ban resulted in at least tens of thousands of people using my libraries not being able to access the source codes, not being able to report bugs or seek assistance when they're stuck. Some of my libraries also relied on "GitHub Pages" for hosting "static" assets (for example, country flag icons), and those have stopped working properly as a result.
The only hint from GitHub was when I navigated to their website and (only for me) it showed a notification at the top saying: "Your account has been flagged. Because of that, your profile is hidden from the public. If you believe this is a mistake, contact support to have your account status reviewed". I've sent a support request to GitHub, Inc. as soon as I found out about the issue (Ticket ID: 594578).What could possibly be the reason of the ban? Maybe one of my repos contained a mysterious "blacklisted" word? Or maybe I've accidentally called someone a moron on the internet (happens to anyone)? Does it really justify silently wiping a bunch of useful open-source projects hundreds of thousands of people rely on in production?
This incident should teach us all that corporations are still corporations, even when proclaimed the heart of open source, even when they've played a huge role in growing the open source community to its current state.The main focus of every corporation are good "public relations" image and silky-smooth operation. This giant machine can be your best friend as long as you don't stand in its way and are good for its business. But if you happen to get in the way, it can simply screw you over and won't even notice.