Stateless Auth w/ JSON Web Tokens
summary
Compares Rails sessions to JWTs and shows concrete tradeoffs: JWTs are signed not encrypted and carry claims like exp, iat, nbf and sub so clients can read them; common revocation patterns include embedding a password-hash fragment, storing a user-level min_iat timestamp, or issuing a jti and checking it server-side; warns that pure stateless JWTs can’t revoke individual sessions without extra storage; mentions libraries (knock, devise-jwt, rollout) and recommends implementing revocation.
AI-written summary · about
chapters (35)
- 0:00Introduction
- 0:32API Authentication
- 1:23Tokenbased Authentication
- 2:05Problems with Tokenbased Authentication
- 4:43Authentication Tokens in Plain Text
- 6:37The Problem
- 7:43Encryption
- 9:00JSON Web Tokens
- 10:09Data
- 10:40Header
- 11:20Body
- 11:54Signature
- 12:59Claims
- 14:52Rails vs JSON Web Tokens
- 15:39JavaScript Object Signing
- 16:00Why Stateless Authentication
- 18:06Force Log Out
- 19:25Password Hash
- 19:37Session
- 20:12Password
- 20:52Minimum Issue
- 21:11JSON Token Identifier
- 21:38Disadvantages
- 22:23JSON Web Token Advantages
- 23:11JSON Web Token Permissions
- 23:56Selfcontained expiration handling
- 24:49Scalability
- 25:33Information Sharing
- 26:22Open Standard
- 27:19Language Support
- 27:46Rails implementations
- 29:26Benefits of JSON Web Tokens
- 30:25Revocation Technique
- 30:54Why JSON Web Tokens
- 33:01Thomas Whittington
related talks
32mPortable Sessions with JSON Web Tokens
15mJWTs And Why They Suck
45mJWT - To authentication & beyond!
38mAuthentication as a Microservice: Portable Customer Identity Management
37mKnock knock, who's there? Authenticating your single page apps using JSON Web Tokens
19mJWTs Explained
32mTips and Tricks for JSON Web Tokens (JWTs)
54mJSON Web Tokens Suck