Confusion with JWT
up vote
0
down vote
favorite
I'm creating an API for a mobile application that will display medical data.
I want to use a JWT token with a refresh token. But I'm really confused with JWT.
As JWT is stateless, once the token is issued, you have no way to invalidate it (you can save the token in your DB and invalidate it, but I think it removes the interest of using such a token).
A refresh token is like the login + password (as you can get a JWT token with it) of a person, and I don't really understand the value either (except allowing the user to ALWAYS stay connected).
If someone can get a refresh token, this person can get as many JWT token as he wants, and do a lot of request on behalf of the user it belongs.
Should I use a simple token for my authentication?
jwt
asked 19 hours ago
cappie013
1,1171019
add a comment |
up vote
0
down vote
favorite
I'm creating an API for a mobile application that will display medical data.
I want to use a JWT token with a refresh token. But I'm really confused with JWT.
As JWT is stateless, once the token is issued, you have no way to invalidate it (you can save the token in your DB and invalidate it, but I think it removes the interest of using such a token).
A refresh token is like the login + password (as you can get a JWT token with it) of a person, and I don't really understand the value either (except allowing the user to ALWAYS stay connected).
If someone can get a refresh token, this person can get as many JWT token as he wants, and do a lot of request on behalf of the user it belongs.
Should I use a simple token for my authentication?
jwt
asked 19 hours ago
cappie013
1,1171019
Are you using any concrete library? Anyway, you can invalidate a token issued by checking the time where it was issued and write a business rule to check to not accept tokens ofcurrentTime - tokenIssuedTIme > TTL(being TTL the time you want to allow a token to be used).
– Dez
19 hours ago
@Dez I'm using a Ruby lib. You don't even need to do that, you can just set aexpattributes to the token
– cappie013
18 hours ago
Ah, now I understand what you meant. The value of the refresh token is quite clear for me. How would you feel as an user to have to enter your login and password each time you perform an action? Refresh token is the system that avoids that while maintaining a layer of security by expiring the JWT token with short access times. So you use refresh token to avoid asking the user to authenticate. About someone getting the refresh token, you have to manage to blacklist them and also you should have another layer of security by requesting an authorization in the request using the refresh token.
– Dez
18 hours ago
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I'm creating an API for a mobile application that will display medical data.
I want to use a JWT token with a refresh token. But I'm really confused with JWT.
As JWT is stateless, once the token is issued, you have no way to invalidate it (you can save the token in your DB and invalidate it, but I think it removes the interest of using such a token).
A refresh token is like the login + password (as you can get a JWT token with it) of a person, and I don't really understand the value either (except allowing the user to ALWAYS stay connected).
If someone can get a refresh token, this person can get as many JWT token as he wants, and do a lot of request on behalf of the user it belongs.
Should I use a simple token for my authentication?
jwt
asked 19 hours ago
cappie013
1,1171019
I'm creating an API for a mobile application that will display medical data.
I want to use a JWT token with a refresh token. But I'm really confused with JWT.
As JWT is stateless, once the token is issued, you have no way to invalidate it (you can save the token in your DB and invalidate it, but I think it removes the interest of using such a token).
A refresh token is like the login + password (as you can get a JWT token with it) of a person, and I don't really understand the value either (except allowing the user to ALWAYS stay connected).
If someone can get a refresh token, this person can get as many JWT token as he wants, and do a lot of request on behalf of the user it belongs.
Should I use a simple token for my authentication?
jwt
jwt
asked 19 hours ago
cappie013
1,1171019
asked 19 hours ago
cappie013
1,1171019
asked 19 hours ago
cappie013
1,1171019
asked 19 hours ago
cappie013
1,1171019
asked 19 hours ago
cappie013
1,1171019
1,1171019
Are you using any concrete library? Anyway, you can invalidate a token issued by checking the time where it was issued and write a business rule to check to not accept tokens ofcurrentTime - tokenIssuedTIme > TTL(being TTL the time you want to allow a token to be used).
– Dez
19 hours ago
@Dez I'm using a Ruby lib. You don't even need to do that, you can just set aexpattributes to the token
– cappie013
18 hours ago
Ah, now I understand what you meant. The value of the refresh token is quite clear for me. How would you feel as an user to have to enter your login and password each time you perform an action? Refresh token is the system that avoids that while maintaining a layer of security by expiring the JWT token with short access times. So you use refresh token to avoid asking the user to authenticate. About someone getting the refresh token, you have to manage to blacklist them and also you should have another layer of security by requesting an authorization in the request using the refresh token.
– Dez
18 hours ago
add a comment |
Are you using any concrete library? Anyway, you can invalidate a token issued by checking the time where it was issued and write a business rule to check to not accept tokens ofcurrentTime - tokenIssuedTIme > TTL(being TTL the time you want to allow a token to be used).
– Dez
19 hours ago
@Dez I'm using a Ruby lib. You don't even need to do that, you can just set aexpattributes to the token
– cappie013
18 hours ago
Ah, now I understand what you meant. The value of the refresh token is quite clear for me. How would you feel as an user to have to enter your login and password each time you perform an action? Refresh token is the system that avoids that while maintaining a layer of security by expiring the JWT token with short access times. So you use refresh token to avoid asking the user to authenticate. About someone getting the refresh token, you have to manage to blacklist them and also you should have another layer of security by requesting an authorization in the request using the refresh token.
– Dez
18 hours ago
Are you using any concrete library? Anyway, you can invalidate a token issued by checking the time where it was issued and write a business rule to check to not accept tokens of
currentTime - tokenIssuedTIme > TTL (being TTL the time you want to allow a token to be used).– Dez
19 hours ago
Are you using any concrete library? Anyway, you can invalidate a token issued by checking the time where it was issued and write a business rule to check to not accept tokens of
currentTime - tokenIssuedTIme > TTL (being TTL the time you want to allow a token to be used).– Dez
19 hours ago
@Dez I'm using a Ruby lib. You don't even need to do that, you can just set a
exp attributes to the token– cappie013
18 hours ago
@Dez I'm using a Ruby lib. You don't even need to do that, you can just set a
exp attributes to the token– cappie013
18 hours ago
Ah, now I understand what you meant. The value of the refresh token is quite clear for me. How would you feel as an user to have to enter your login and password each time you perform an action? Refresh token is the system that avoids that while maintaining a layer of security by expiring the JWT token with short access times. So you use refresh token to avoid asking the user to authenticate. About someone getting the refresh token, you have to manage to blacklist them and also you should have another layer of security by requesting an authorization in the request using the refresh token.
– Dez
18 hours ago
Ah, now I understand what you meant. The value of the refresh token is quite clear for me. How would you feel as an user to have to enter your login and password each time you perform an action? Refresh token is the system that avoids that while maintaining a layer of security by expiring the JWT token with short access times. So you use refresh token to avoid asking the user to authenticate. About someone getting the refresh token, you have to manage to blacklist them and also you should have another layer of security by requesting an authorization in the request using the refresh token.
– Dez
18 hours ago
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53237449%2fconfusion-with-jwt%23new-answer', 'question_page');
}
);
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Are you using any concrete library? Anyway, you can invalidate a token issued by checking the time where it was issued and write a business rule to check to not accept tokens of
currentTime - tokenIssuedTIme > TTL(being TTL the time you want to allow a token to be used).– Dez
19 hours ago
@Dez I'm using a Ruby lib. You don't even need to do that, you can just set a
expattributes to the token– cappie013
18 hours ago
Ah, now I understand what you meant. The value of the refresh token is quite clear for me. How would you feel as an user to have to enter your login and password each time you perform an action? Refresh token is the system that avoids that while maintaining a layer of security by expiring the JWT token with short access times. So you use refresh token to avoid asking the user to authenticate. About someone getting the refresh token, you have to manage to blacklist them and also you should have another layer of security by requesting an authorization in the request using the refresh token.
– Dez
18 hours ago