More boilerplate Code and bandwidth but it works fine.
My issue with the article is that we’ve generally stopped building our own auth and now lean into using cognito or auth0 for authentication for the sites we build for third parties. Those services provide so much more out of the box then a home rolled solutions (MFA etc).
Imagine you're connecting to a service that uses JWT for sessions so they don't have to store anything server-side.
Let's say you have a token with an IAT of yesterday and and EXP of, say, a month from now.
Further, your browser gets infected with malware and the attacker steals your token. You rebuild your computer from a fresh install.
How does the service invalidate the token while still being stateless? It has 30 days left.
Your next move is:
> _
JWTs were designed to be single-use (or very, very short lived) claims (with optional cryptography features).
It was never meant to be "offload everything to the client and obviate the need for server-side storage". It was never meant to be the new hotness among the NoSQL Scalability crowd.
What if a user changes their password? Until that token hits its timing limit, they've got free reign. Or, you use denylists, requiring the database again.
I see the value of signed tokens in complex infrastructure where you want to have one heavily guarded system doing the authentication and token assignment and then a bunch of other systems just validating the tokens.