Why not to use JWT in 3 Minutes: http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-fo...
Joepie91 once did a small nodejs project for me, that's why I recognized your link.
I'm kinda worried as "not an acquaintance" about his post about depression and that he didn't post anything since 2016.
Anyone know what happened?
His GitHub still seems to be active (https://github.com/joepie91).
I just haven't updated my blog for quite some time, due to a combination of circumstances. I'll probably start blogging again at some point in the near future.
Some useful parts of JWTs is they can contain information that can act as a cache so that you don't have to go to the server to show certain parts of your UI or things like names and so on.
It's worth evaluating them for your use case rather than assuming they are 100% bad because of the reasons outlined in the article.
That doesn't really help, because now you need some other sort of token to authenticate the user for handing out a new short-lived token, and that new token now has the same inability-to-revoke problem. You've just moved the problem.
> Some useful parts of JWTs is they can contain information that can act as a cache so that you don't have to go to the server to show certain parts of your UI or things like names and so on.
You don't need a JWT for this. You can just store that in localStorage directly. JWT is not a storage mechanism, it's more of an encoding format.
No you don't, as stated you can refresh your token before it expires.
> You don't need a JWT for this. You can just store that in localStorage directly. JWT is not a storage mechanism, it's more of an encoding format.
I think you can validate the authenticity of your JWT without having to go to a database. This is much more secure than local storage or even a plain old cookie.
JWT provides a useful set of features and just because in your opinion it isn't useful plenty of people disagree with your points.
And if for some reason you have a weird freak edgecase where you really do need a cryptographically signed stateless token... JWT is unsafe[1] and you want PASETO[2] instead.
[1] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...
Edit: To be clear, with "API" I'm assuming you mean "third-party API", in the original sense of the word. If you just mean "a bunch of endpoints for my SPA", then you should use none of these things, and just use sessions. It's not really an "API" in the "API key" sense.