Hacker News Reader

Comment by rmedaer | Hacker News Reader

Hi shoo, thanks for your feedback. At this point in time this is only a proposal. A proposal which needs to be challenged. So thanks again for your useful feedback.

Indeed the goal is to limit the size of JWT tokens. I can't tell you if it really improves the performances for now. I already started a spreadsheet to compare the bitmap scope list against the space-separated list. Although I need some real examples and metrics to do a relevant analysis of the impact.

One of the questions you raised is about the scopes commonly used. Should we defined a shared dictionary/registry ? Maybe. I would propose to open an issue on Github to discuss about that. Here it is: https://github.com/rmedaer/rmedaer.github.io/issues/2

If there is more interest in this proposal, I would propose to create a dedicated repository where ~~I~~ we could discuss, compare and challenge it.

Kind regards,

View on HN

> Indeed the goal is to limit the size of JWT tokens.

At work we just implemented some M2M auth using JWT[1]. The other party requires a full certificate chain as our identification and RS256 as algorithm, so our "compact" tokens end up around 8k in size.

At least the auth token we get back lasts a couple of minutes.

[1]: https://difi.github.io/felleslosninger/maskinporten_protocol...

I see that you have a lot of scopes (https://github.com/difi/felleslosninger/blob/ad9ef79b4fef61f...). Especially from 3rd parties (https://integrasjon.difi.no/scopes/all https://integrasjon-ver2.difi.no/scopes/all)

Do you have some statistics about that ? For instance, do you know how many scopes are usually requested, on average ?

Unfortunately not. We're just outsiders, using Maskinporten to get an auth token to be used against the REST API of some other gov't agency. For that we use one of two scopes, prod scope or test scope, as they (the agency we talk to) haven't narrowed it down further yet.

But if you're interested maybe try to contact the Difi folks running Maskinporten, from my impression there's a high chance there's someone willing to share there.

Maskinporten is being phased in as the primary M2M auth solution for any Norwegian gov't agency, so they're bound to get a lot more "users" (agencies), and hence scopes, going forward.

What about using a .well-known path and standarizing via internet draft heading towards RFC. (Assuming there's even a registry for these paths.)

The format could be a simple json file listing supported dictionary items in order grouped by the key used in the JWT json itself.

Maybe a special claim could point to the url or use "wk" as a special value to direct it to the .well-known path on the issuer?

Reply on news.ycombinator.com