VEvelmu·Nov 26, 2020Submission
And that, kids, is what makes OSS terrible for many people
3 points · Open discussionlcobucci
jwt
PHP2017–2020
lcobucci / jwt
jwt
A simple library to work with JSON Web Token and JSON Web Signature
2Distinct people
2Mentions
0Explicit recommenders
7.5KGitHub stars
What to know before exploring
What it is
A simple library to work with JSON Web Token and JSON Web Signature
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year2 dated mentions
Observed mentions: 2017-12-27 01:44:36 UTC to 2020-11-26 18:46:00 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
2 sourcesI find it hard to recommend JWT unless you're already a security expert.
This is unfortunate, since JWT was meant to bring client-side tokens to the masses, but the reality is that:
1. JWT has amazing cross-language support, but most of the libraries out there are unaudited, and even the ones that are audited can change and, let's say, make the 'None' signer the default one:
https://github.com/lcobucci/jwt/commit/6507ac39be5a5e06457c8...
2. JWT can be used somewhat responsibly, but the JWT spec does n't enforce any security measure and doesn't even contain proper recommendations like:
a. Never use the None algorithm.
b. Never use the RSA algorithm.
c. Basically, only use HMAC (or Ed25519 if supported).
d. Always include an issue timestamp ('iat' claim) and possibly a unique nonce ('tid') to make tokens unique.
e. Always do key rotation us
Read the rest
ing 'kid'.
f. Implement a blacklist-based token revocation mechanism (or use short-lived access tokens backed by DB-based refresh tokens).
g. Include the token expiry claim! Seriously, JWT doesn't even require token expiry!
h. Don't use JWE.
h. Associate your keys with signature algorithms, and _make sure that token is signed with the right alorithm_:
https://auth0.com/blog/critical-vulnerabilities-in-json-web-...
3. I'm yet to encounter a library which enforces good defaults on your JWT usage. Some libraries validate expiry by default (if the claim exists), but from my experience most of them don't set it by default. Almost no library contains an convenience method for setting the issue time or a nonce, let alone setting them by default.
4. No JWT library I know of provides help for implementing basic features like key rotation/revocation and token revocation. Without these features JWT security model becomes vastly inferior to database-backed tokens.
The reality is that developers implementing JWT choose it exactly because they don't want to delve into all these complications of using tokens, so they just pick up a library and hack something around it, expecting the JWT library to take care of all the security issues for them.