Introduction to PASETO (platform-agnostic security tokens).
summary
Shows why JWTs fail in practice by naming concrete exploits — none algorithm, algorithm confusion, kid header injection and short HMAC keys cracked with a jwt cracker — then presents PASETO’s concrete design choices: fixed versions (v2), two purposes, v2.local tokens that are always encrypted, and separate symmetric vs public modes. Shows a Java library demo that creates and parses tokens, prints claims, and lists language implementations and hard‑coded API patterns for safer defaults.
AI-written summary · about
chapters (17)
- 0:00Introduction and setup
- 1:10What is PASETO
- 3:23JWT recap and JOSE standards
- 4:29Signing vs encryption in JWT
- 5:33JWT vulnerabilities and exploitation
- 9:07Key size and JWT cracking
- 11:21Criticism of JWT and industry issues
- 12:52PASETO overview and benefits
- 13:55PASETO format and versions
- 14:41Local vs public PASETO tokens
- 15:46PASETO payload and claims
- 16:30PASETO footer and key rotation
- 17:13PASETO implementations
- 17:57JWT vs PASETO comparison
- 18:20PASETO design principles
- 20:07PASETO demo in Java
- 21:25Conclusion and resources
