JWTs - Patterns and Anti-patterns in Authentication

JWTs - Patterns and Anti-patterns in Authentication

Explore patterns and anti-patterns of JSON Web Tokens (JWTs) in this 33-minute conference talk from LASCON. Delve beyond basic JWT concepts to examine various use cases, including stateless tokens, server-side sessions, and service-to-service authentication. Learn about potential pitfalls such as weak HMAC secrets, lack of revocation mechanisms, and fragile key rotation. Discover alternatives like macaroons and gain insights on when to avoid using JWTs for sessions. Understand best practices for implementing JWTs securely, including the use of trusted libraries and registered claims.