fallow bramble
Hi everyone,
I am currently develop a small web app with services to createAccount, login/logout, search ...etc, the aim it's to commercilize it then, and I have a question about the auth service. Which is the goods way to auth users on the app :
Thank you by advence 🙂
grand sorrel
Hi everyone,
I am currently develop a small web app with services to createAccou...
simple and secure cookie based auth: https://thecopenhagenbook.com/
fallow bramble
But is it a very secure way for B2C app where the aim is to commercilize it ? And how can you handle the logout properly ?
because I thought about it this way, but the problem is that at the time of logout it is not very secure, and in addition you have to manage a blacklist that you store somewhere (redis for example), which adds a little complexity
grand sorrel
But is it a very secure way for B2C app where the aim is to commercilize it ? An...
this is pretty much the most common way of doing auth ever. you keep state and tokens server side, deleting a token means logging out a user linked to it
you don't need JWT unless you have a huge web of microservices, neither you need any external auth services unless you want SSO
you described it as a "small web app" this approach is the one that keeps things the most simple.
a small web app sounds to me like something that would run on a single monolithic codebase, with a single instance of the database, no cache. you can support thousands of concurrent users with a setup like that, depending on what your web app does
grand sorrel
a cron job is just fine if you are using this method honestly
you could have a million orphan tokens and it wouldn't really matter for performance
grand sorrel
simple and secure cookie based auth: https://thecopenhagenbook.com/
^ this method has been proven to work just fine since basically they invented cookies. it's the more standard, mature method, it has the most libraries and it's focused at small web applications
JWTs are suited to microservice architectures, which you shouldn't do unless you have many teams in an application
the benefits of microservices die the moment your team size is lower than like, 5 people
then JWT is straight up worse. a lot of the time people end up reinventing stateless tokens with JWT trying to find a way of logging out a user server side...
why? if this where a real problem, people would store their data in big excel-like sheets.
you wouldn't store an is_banned field in your user either, that's a naive implementation. you would at minimum want a reason for the ban
you have SQL, use it, don't be scared of foreign keys
any respectable application should have a reasonably populated table of why, how and when someone was banned
not really, your JWT session would stil be valid. you still have to log the user out: now you have the problem of a banned user with a valid session. which is not possible when you have stateless sessions
revoking the session is something you should do anyways with JWT, and the issue is that you can't. because that's one of the main reasons JWT is bad for sessions
so you end up storing state in the server anyways to revoke the session. and now you've reivented stateless sessions... except now you have state in your JWT, and state in your database, and it suddenly became way worse and more complex
unique shoal
they would be roughly equivalent in the way you described, except that you're now introducing a ton of crypt and parsing code for no particular reason
rather than biasing towards what has already been implemented, take a step back: why would you add all of that complexity when it doesn't actually buy you anything?
(not that it can never buy you anything, but in this particular instance is doesn't sound like it is)
narrow barn
you’ve seen this oldie:
vapid totem
Yeah, I'm using JWT to store session key. My reason is I don't have to query database if the JWT is invalid, which is absolutely over engineering since the QPS for my service probably under one. 💦
grand sorrel
Yeah, I'm using JWT to store session key. My reason is I don't have to query dat...
it's very easy to setup an in-memory cache for the tokens and give it like a 5 minute lifetime
fallow bramble
First of all, I apologize for the delay in responding, and thank you very much for your answers. Then, yes, I mentioned a small web app, but ultimately it will be an app that will grow, particularly in terms of architecture, moving more towards a microservice. Therefore, to avoid reimplementing authentication at that point, I prefer to implement the most suitable and best method now.
The problem with cookies and server-side sessions is that theft and use of cookies by a third party is more likely, and therefore not secure. That's why I was leaning towards JWT, and perhaps Keyclock for that, except that Keyclock is more B2B than B2C, and Okta is expensive.
narrow barn
The problem with cookies and server-side sessions is that theft and use of cookies by a third party is more likely, and therefore not secure.
more likely than which case exactly ?
fallow bramble
If we store the session id on the cookies, a third-party part can impersonate a user, via XSS, sniffing, the attacker forces the user to log in with a controlled session_id ...etc
narrow barn
and they couldn't take the jwt and do the same?
and there is a thing called secure cookies
fallow bramble
The token will have a small expiration, and will require a refresh_token to generate a new one, in addition the use of a header allows to avoid CSRF and access to the information via third-party scripts and
narrow barn
so you're here in the flow chart, gotcha 🙂
this being said, I'd sign session cookies just to add some layer of protection, so who am I to throw the stones, yet maybe do read http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/ (btw... very bad for a crypto/security site to not use https... oh well...)
fallow bramble
Thanks for the two links, I'll read them 🙂
I find that choosing the right authentication method is always complicated when developing an app. There are so many, and knowing which one is best for you is getting more and more complicated :/