Hacker News Reader

Comment by lima | Hacker News Reader

Why do people use stateless authentication when there's absolutely no need to do so? Unless you're very large, request authentication is not going to be your bottleneck.

One of your users session token was compromised - your only recourse is changing the secret and logging out everyone.

See: http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-fo...

View on HN

I am not sure how this comment applies? The choice for oauth2_proxy in my case was, because it is a solution that already existed. You certainly could put a stateful session service as the auth-request backend, my Lua script is agnostic to that. As an example: For one project I put a service that validated IP addresses against Tor's RBL behind nginx' auth_request module.

Yes I'm specifically talking about oauth2_proxy.

Cool project, by the way! Thank you for making it open source. I had a similar use case where I added an extra Nginx just for auth_request, this makes me reevaluate.

I think performance is not the main reason for going stateless for most people. With stateless you can more easily achieve HA of your auth server. Since it is all stateless your auth servers dont need to know about each other. However with stateful you need somesort of special HA construct between instances of your auth servers otherwise they don't know which sessions exist.

in a state less auth layer you can't do blacklisting of token. hence if your security requirement are somewhat in the "safer" ranger. you will need to use a bit of state to whitelist or blacklist tokens.

Reply on news.ycombinator.com