JSON Web Tokens Suck
summary
Claims that JWTs are great for web auth turn out to be wrong: most JWTs are not encrypted and stateless JWTs embed full user records so they balloon (example: a JWT 179 bytes vs a signed session ID 64 bytes; real records make tokens 25–50× larger and often exceed the 4KB cookie limit), forcing storage in local storage which opens XSS theft, while cookies with HTTPOnly and SameSite prevent CSRF; a Node.js jsonwebtoken test script demonstrates the size and revocation tradeoffs, so use JWTs only as short‑lived one‑time tokens.
AI-written summary · about
chapters (24)
- 0:00Start
- 2:07What are JWTs?
- 3:11What's a Cryptographic Signature?
- 6:09Way 2: Cookies
- 10:13Term: Session Cookie
- 11:04BONUS: What's the difference between a Session Cookie and a Stateful JWT?
- 11:31Term: Cookies
- 12:03Creating Cookies
- 12:55NOTE: Required Cookie Flags
- 13:47Reading Cookies
- 14:26Term: Local Storage
- 15:16JWTs are Easier to Use
- 16:19Score
- 16:54JWTs are More Flexible
- 23:35DETOUR! What is CSRF?
- 30:25JWTs Are Better for Cross Domain
- 33:28JWTS Work Better on Mobile
- 34:09JWTs are More Efficient
- 43:03Session Scaling (basic)
- 43:49Session Scaling (advanced)
- 44:38Session Scaling (super advanced)
- 45:16JWTS Are Secure By Design
- 49:03JWT Use Cases (cont)
- 53:06Thank you!
