Hacker News Reader

Maybe I missed something, but I was surprised there was no mention of JSON Web Tokens (JWT). See [0] (overview) and [1] (example usage).

[0] http://self-issued.info/docs/draft-ietf-oauth-json-web-token...

[1] https://github.com/mattupstate/flask-jwt

View on HN

At the time of writing (September 2013), the JWT spec would have been only on it's 12th draft--it's had 19 follow-up drafts since then. It's possible that the author didn't know about them at all.

As you say, the JWT spec was not as mature at the time of writing.

(Assuming you're the author -- who knows though.) Now that the JWT spec is mature and there are some nice implementations of it, do you think it's a good option for token-based authentication?

Yes, I'm the author. Long as the JWT spec implements a strong method of encryption , it's a good option.

The JWT was not as mature at the time of writing. In any case, The structure of the token itself is open for extension. The pattern focuses on the manner in which the token is leveraged.

Reply on news.ycombinator.com