The Surprising Story About JWT

The origins of JSON Web Tokens (JWT) trace back to a proposal by Mike B. Jones, John Bradley, and Nat Sakimura in 2010 under the Internet Engineering Task Force's (IETF) JSON Object Signing and Encryption (JOSE) working group. The goal was to create a secure, standardized token format for streamlined data exchange. By May 2015, JWT was officially standardized as RFC 7519, marking its place as a cornerstone in web security.

⌛ Chapters:
00:00 Prologue
01:09 Chapter 1 - The Origins of JWT
03:39 Chapter 2 - Background
6:03 Chapter 3 - JWTs Aren’t Made for Authorization
8:37 Chapter 4 - Disadvantages of JWT
10:27 Chapter 5 - The Conclusion

[AmanRawat-sm]

Secure, stateless, and still somehow stressful. Classic JWT. 😅

[codeninja-dw]

In the world of reaction videos on coding articles 😅, great to see the quality of your videos increasing.

[esra_erimez]

The importance of this video simply cannot be overstated. Well done.

[CloudiaNgaming]

Nice video, I can see you put in a lot of effort! :)

However I think it sometimes is a little too expressive. You already have good content, so you dont need to satisfy us with new visuals every second of the video to make it great.

Nice work. 😄 You’ll get more viewers very quickly with this high quality!

[duckboi]

Great video editting! The cinematic effects are amazing and very enjoyable.

[Karurosagu]

My only problem with JWT is that I find it very complex and hard to understand, and yet a lot of people implement it without knowing how it exactly works, actually, I think that a lot of devs that don't even know what a cookie is don't now what JWT is either, and yet they use it because it is "easy"

They may be easy to use but they are more complex than serverside sessions with cookies, which are a lot more simpler to use, even though they require more work

[jozsefsebestyen]

Short living JWT is for service-to-service communication in trusted network. For external systems use sessions which can be revoked in case of misuse. It is an implementation detail if you map your session to short living JWT for apps internal communication on each request.

[codingwithzak]

Great quality video! Love to see the effort being put into it

[hebersolano]

Really good video, it's not common to see this days

[dot]

No more ads interrupting the flow of the video please

[DiegoSanchez-ihsd]

I don't like that corners of the video are blurred, it worsens readability.

[godsgiftmonday]

The best practices is hybrid approach
JWT + session 🛡️ for maximum security ❤

[definitlyarealperson]

Love the video!
Just a quick question:
In the example at 10:52, doesn’t good separation of concerns solve this problem?
Why does anybody need to manage the algorithms of JWT after its initial implementation?

[brigadut]

JWT is safe unless you use it in wrong way like exposing it in local storage or not encrypting the data that inside the token

[abdirahmann]

all the problems mentioned are just skill issues tbh, am too lazy to write a gigantic comment elaborating solutions to all these "problems" but anyways!

[neversleepy]

TLDV; With Vigilance and Precision, JWTs Remain Not Just a Tool, but a Testament to the Evolving Art of Web Security.

[KallMeMoh]

I don't understand why JWT is blamed for the mentioned reasons?
To me it looks more like a dev's problem of lack of a good understanding of web security.

Your fonts in this video are too blurry.

[k_gold]

Please use a good font, this isn't 1450

[Leandrys_]

That's fake, if you sign the token correctly it can be spoofed ... The token signature will not match and will be declined, every change in the token will change the signature so... Forget this idea