Hacker News Reader

I was under the impression that the right way to use JWTs is as object capabilities, much like Kerberos tickets.

Can you expand a little more on how you believe they should be used versus how they shouldn't?

I guess it depends on how you use it yeah, like the token can be used to refer to a specific resource, which is then granted to whoever has the token. But obviously you can just treat them as a way of doing traditional identity based access control if you want, which isn't the most effective way of using them. JWTs don't let you easily revoke them, or narrow access to specific resources. That's something you have to do yourself, or rely on a library to do, but that would be built into an ocap based system.

Reply on news.ycombinator.com