Is using JSON Web Token based authentication on the web safe?

Question

We've been using cookie based authentication on web using PassportJS. But recently started using JSON Web Token based authentication for android app. Is it safe / does it make sense, to move the web authentication method to token based authentication instead of continuing cookie / session based auth? (Just to keep the auth method consistent across platforms)

Rupesh Pawar · Accepted Answer

Generaly it's safe but it depends how we implement it.

Advantages of JWT.

Easier to (horizontally) scale
Easier to use
More flexible
More secure
Built-in expiration functionality
No need to ask users for 'cookie consent'
Prevents CSRF
Works better on mobile
Works for users that block cookies

The criticisms of JWT seem to fall into two categories:

Criticizing vulnerabilities in particular JWT libraries, as in this article.
Generally criticizing the practice of using any "stateless" client tokens. Because there's no great way to revoke them early while remaining stateless, etc.

Mostly people face issue with JWT beacuse of either mis-implementation or misuse of JWT.

Sumit Raj · Answer

Yes, it totally safe. We use token based authentication in our applications.We use Django/MongoDB. Since mongodb doesn't have native support in Django we couldn't use Django's auth module.Only issue you may face is that everytime you close the tab in the browser you may need to login again unless you store the token in browser.

Sumit Raj · Answer

Yes, it totally safe. We use token based authentication in our applications.We use Django/MongoDB. Since mongodb doesn't have native support in Django we couldn't use Django's auth module.Only issue you may face is that everytime you close the tab in the browser you may need to login again unless you store the token in browser.

Sumit Raj · Answer

Yes, it totally safe. We use token based authentication in our applications.We use Django/MongoDB. Since mongodb doesn't have native support in Django we couldn't use Django's auth module.Only issue you may face is that everytime you close the tab in the browser you may need to login again unless you store the token in browser.

Sumit Raj · Answer

Yes, it totally safe. We use token based authentication in our applications.We use Django/MongoDB. Since mongodb doesn't have native support in Django we couldn't use Django's auth module.Only issue you may face is that everytime you close the tab in the browser you may need to login again unless you store the token in browser.

Sumit Raj · Answer

Yes, it totally safe. We use token based authentication in our applications.We use Django/MongoDB. Since mongodb doesn't have native support in Django we couldn't use Django's auth module.Only issue you may face is that everytime you close the tab in the browser you may need to login again unless you store the token in browser.