Don’t Use JWT for Login Sessions

Рет қаралды 61,919

Жыл бұрын

Why you shouldn't use JWT tokens for user authentication in your app (vs sessions).
⭐ Get my full-stack Next.js with Express & TypeScript course: codinginflow.com/nextjs
✅ Get my free React Best Practices course: www.codinginflow.com/reactbes...
💌 Join my newsletter for regular web dev tips: codinginflow.com/newsletter
💬 Join our developer community on Discord: codinginflow.com/discord
📣 Follow Coding in Flow on social media:
Twitter: / codinginflow
Instagram: / codinginflow
TikTok: / codinginflow
Facebook: / codinginflow

Пікірлер: 68

@codinginflow 6 ай бұрын

Get my FREE React Best Practices course: codinginflow.com/reactbestpractices

@depression_plusplus6120 6 ай бұрын

Well.. From stateless we returned back to stateful... indirectly but yes🤣

@MechMK1 2 ай бұрын

The real advantage of JWTs is that the server doing the authentication doesn't need to be the same server who does the validation. This is really good for SSO applications. And it's possible to invalidate a JWT if you'te willing to give up the idea of statelessness

@jitx2797 2 ай бұрын

Can you please explain the second part

@aribzaman7053 Ай бұрын

@@jitx2797 statelessness here basically means that server doesn't keep record of which token it issues, so the server can't recognise the coming subsequent requests. And when we keep records of tokens to blacklist in a database then we will this idea of statelessness

@power_bgmi 2 күн бұрын

@@jitx2797 You can maintain a blacklist or whitelist of all the assigned JWT's, a expiresOn property can be assigned to the JWT to verify if its still valid or no!

@Taki7o7 Жыл бұрын

And not matter which of those you will use, every junior pentester is happy about you making it so easy to intrude ^^

@codinginflow Жыл бұрын

🙄

@comosaycomosah 2 ай бұрын

Facts on facts lol

@ayukalvieri3154 Ай бұрын

What if I just use NextJs as the frontend and the backend/ API in another language on another server where you don't have access to the database. Why shouldn't I use jwt

@cesarpinto3276 2 ай бұрын

I've implemented short lived JWT (15 min) tokens with refresh tokens and token invalidation in the .NET stack and it wasn't too hard, it was actually quite nice. I do like the statelessness of it, but it's like anything, not a silver bullet, I'd say it just depends on what your use case is. There is a place for both and pros and cons in both.

@dileepa-mn2to 9 күн бұрын

want a video about JWT handling with redis

@IamPali2024 2 ай бұрын

Why have JWT of you want to be stateful… Also, you can use openid in which contains a client and server side packages that will help you accomplish this

@mukithasan9684 2 ай бұрын

In Django it's very easy usung simple jwt it's all come in one pkg

@deathdefier45 7 ай бұрын

Hey express-session doesn't work we'll with redis anymore, can you show us a basic configuration where it works?

@codinginflow 7 ай бұрын

You can see a working setup here: github.com/codinginflow/nextjs-express-typescript-course

@alitonoliveira1700 2 ай бұрын

how to propperly login by using firebase auth?

@kishDoesThings 8 ай бұрын

People say session is only stored on one instance of a server,which makes it troublesome to always authenticate.

@sneak9407 6 ай бұрын

You can configure your sessions to be stored on a database. Hence, all instance can pull from the same db and have the same sessions. If your issue is multiple queries to the DB, them thats why he spoke about using redis. Pulling the sessions will be faster.

@alaskandonut 29 күн бұрын

Sessions should be in a database from what I can tell. At the end, he says you can store session info on the server for quick access, but there’s gotta be a way of reasonably keeping sessions on many instances of the server (imagine having many many servers with a horizontal scaling solution). You have to use some sort of sync mechanism.

@kasper369 Ай бұрын

We can't have good thing in life

@codinginflow Ай бұрын

sessions are a good thing

@sidthetech7623 9 ай бұрын

Don't you need to query a central DB (or cluster) when your platform gets to the point where you need to scale to multiple server instances from the bastion by deploying copies of itself behind a load balancer?

@codinginflow 8 ай бұрын

There are solutions for that if you ever reach that size

@alaskandonut 29 күн бұрын

@@codinginflowcan you name drop some. I’d like to learn how to deploy my node server with some horizontal solution & learning how to keep some session info on each (and in sync) would be nice.

@mrniceguy5731 9 ай бұрын

my teacher

@sandzz 2 ай бұрын

Implementing jwt isn't that hard or time consuming. If you think it will take time, then idk what kinda product you are building

@mdahsanraza 2 ай бұрын

Wait can’t you just delete the token when password is changed! Yes needs db storage but it’s not much of a cost if you ask me!

@codinginflow 2 ай бұрын

Then you're just rebuilding sessions

@samuelvalentine7846 2 ай бұрын

So what happens when your redis database crashes or restarts?

@RaniLink 2 ай бұрын

Highly unlikely. But that’s what replicas and fallback strategies are for.

@yagami-light 3 ай бұрын

It's not difficult at all... I implemented such mechanism recently and it was actually fun to learn about jwt and how it can be implemented securely

@codinginflow 3 ай бұрын

Do you use a refresh token?

@yagami-light 3 ай бұрын

@@codinginflow yes and on client I don't store it in localStorage I just make request to server and verify all the times using axios interceptors

@Vishal-jq3fp 3 ай бұрын

Can you explain the implementation please, would really appreciate it.

@yagami-light 3 ай бұрын

@@codinginflow yes and I am not storing anything in localStorage I am just making api request to my server so that persistent login is there

@yagami-light 3 ай бұрын

that'd be long explanation but in short you have to implement two types of tokens, accessToken (short lived) and refreshToken (long term) everytime your token expires you make a request to your server which generates a new access token for you, also everytime you login you check refreshToken in your database through a middleware so that authenticity of a user making the request is checked.

@JatinderSingh-nr9dn 3 ай бұрын

i made my own jwt session mangement in django

@PennyHerbst 2 ай бұрын

It is always better to use standard solutions! I hope that you are signing the JWTs and that you verify their signature

@isaacjon 6 ай бұрын

So you know backend too?

@codinginflow 6 ай бұрын

Yes

@user-pq9yh Жыл бұрын

So basically if you had to choose between Jwt and Cookies/session you will pick session because of the security it offers and because the session can be invalidated ?

@codinginflow Жыл бұрын

I think so, yes. At least it's easier to implement correctly.

@thatsalot3577 10 ай бұрын

@@codinginflowbut a bit expensive compared to tokens

@__Brandon__ 2 ай бұрын

An in memory database for blacklisted tokens and JWT is much faster and scalable. You just have to keep an the ID around for every blacklisted token which can be very small if you have them expire after a couple days. It's basically just taking the best of sessions and the best of JWT. JWT let's you have a different server do the authentication and you can store things like access/modification rights in the token so you don't have to keep asking the database if a user is allowed to edit something. Instead you just need to check the token hasn't expired and isn't blacklisted and then from there you can skip all the extra reads from your database about wether the can view an asset ect. JWT was made to solve a problem sessions can't do efficiently at scale, but effective use of the tokens still leverages properties that sessions gave us, and that's having state on the server. But minimal state is what we are striving for

@Prag1974 2 ай бұрын

So what should i use for authentication? Tell me the name of the technology I should use for safe authentication. I'm losing a lot of time in the educational series. I want to do something now, but something is always missing. I don't want to use ready backend services (Supabase, firebase). Is there a technology that you can tell me "Learn this technology and you will be able to build a fully secure authentication system"? Please tell me because I don't want to waste time anymore. And one of the things I fear the most is the leakage of users' information from the system I built. That's means i need a safe authentication system.

@codinginflow 2 ай бұрын

Next-auth

@Prag1974 2 ай бұрын

@@codinginflowThank you. I'm going to trust you and I'm going to put all my focus on this, because now I want to complete my project in such a way that it's a safe project. Here's the question: Is this technology absolutely and without a doubt safe to make a full stack web program? I want to use SQL as a database in this project, I don't want any off-the-shelf service. Next - auth, is it FULLY suitable and functional for authentication and authorization? Does it allow me to do database operations through the user? I know I am asking too many questions but I need to know the answers to these questions. Because if Next-auth is suitable for these functions I will put all my focus on it, I don't want to waste time. Life is short. Pardon me for my English.

@codinginflow 2 ай бұрын

@@Prag1974 There are always things you can do wrong to make a website insecure. It's your responsibility as a developer to learn how to do it properly.

@Prag1974 2 ай бұрын

@@codinginflow Yeah I know, but you are saying in the video "JWT is not secure" You are not saying "The developer using the JWT developing website did a fault so JWT is unsecure." I mean you are saying that "JWT is a problem" I want "problemless" technology to use.

@rockyGonnaHurtYou Ай бұрын

@@Prag1974if you never want to deal with problems then you're in the wrong profession bud.

@mohammadjavadnajafi1782 Жыл бұрын

how about using jwt and sotring it in redis so you can easily invalidate them as well?

@codinginflow Жыл бұрын

You can do that. But then you lose the benefit of statelessness and basically rebuild sessions

@mohammadjavadnajafi1782 Жыл бұрын

@@codinginflow yes but the frontend team can handle token by themselves and dont need to deal with cookies security issues

@codinginflow Жыл бұрын

@@mohammadjavadnajafi1782 Tokens have the same (and more) security issues as far as I know. Both can be implemented safely, but JWTs are trickier.

@freshtechtips 9 ай бұрын

@@codinginflowHow about a simple solution like password version, every time user change the password we will increase the number to a higher number and compare the one in database with the one in the jwt Sure it have some downsides but for most apps it works.

@recycle-bin-camp 6 ай бұрын

why it is still used then??

@codinginflow 6 ай бұрын

It's possible to implement them correctly but not how it's shown in most tutorials. You need very short-lived tokens and a refresh mechanism.

@mfiaz7719 Жыл бұрын

Jwt should only be used in intranet communication i.e. backend apps authentication. What’s stopping someone from acting as a server if the client id and secrets are compromised