Tips and Tricks for JSON Web Tokens (JWTs)
summary
Claims that validation needs no state because application servers use public keys and not secrets, concrete example code on GitHub showing Flask decorators composed with the PI JWT library, signature example using Ed DSA, and a deployed pattern that moves verification into enginex middleware so Python services only parse claims. Recommends an access/refresh flow with very short access tokens (about 30 seconds to a minute) and warns about trusting header alg or JKU fields.
AI-written summary · about
chapters (11)
- 0:00JWT introduction and benefits
- 2:10Separate auth from validation
- 4:37JWT structure and fields
- 7:06Python JWT validation
- 11:16Proxy JWT claims use cases
- 13:44JWT security caveats
- 15:28JWT attacks and defenses
- 18:59JWT revocation and refresh
- 22:33JWT middleware validation
- 25:25Summary: distributed trust
- 26:46Q&A
related talks
25mHow JSON Web Tokens Work and Can be Used to Secure Your Single Page Apps
37mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
34mAuthenticating your single page apps using JSON Web Tokens
40mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
15mJWTs And Why They Suck
19mJWTs Explained
40mKnock knock, who’s there? Authenticating your single page apps using JSON Web Tokens
37mAttacking and Defending JWT Tokens: The Ultimate Guide