Hacker News Reader

Comment by ryanbrunner | Hacker News Reader

It's nuts to me that so many companies have moved off cookies for web app auth state. They're simple, they're well supported, they require very little work on the browser side, and the abstractions around them on the server side are basically bulletproof at this point.

I see all this talk about authentication, and it's just literally never been a problem or concern for my company.

View on HN

Aren't JWTs just fancy cookies?

JWTs are frequently stored in LocalStorage which means that any XSS is able to leak the JWT.

Cookies, on the other hand, can be configured to be HTTP-Only and inaccessible to JavaScript on the page. That prevents somebody with XSS from leaking the value without a second server-side vulnerability or weakness.

In addition, JWTs are impossible to revoke without revoking _all_ sessions. This is the biggest weakness, imo, and the reason that they shouldn't be used client-side.

I'm a huge fan of the approach the Ory is taking with Oathkeeper and Kratos: https://www.ory.sh/docs/kratos/guides/zero-trust-iap-proxy-i...

Can't you revoke them the same way you revoke any other auth token and put the token ID in a database somewhere?

it won't be stateless then, and you might as well just use traditional sessions then

Sure, but browsers have done a lot of work to make cookies far more convenient (they're automatically sent with requests, you have browser APIs to work with them), and secure (Secure, HttpOnly, SameSite, etc.)

Cookies are a storage and transport mechanism and JWTs are signed JSON blobs. You could put a JWT inside a cookie.

Reply on news.ycombinator.com