Record · corpus.blog/posts/01a08785-4ff5-7315-9130-346ed609141a

Please Don't Use JSON Web Tokens for Browser Sessions

ianlondon.github.io · published 28 January 2024

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at ianlondon.github.io Wayback capture

1blogs citing

First cited: 4 Jul 2026
Most recent: 4 Jul 2026
Rank this month: not ranked
Links from this post: 27
Words captured: 5,094

Cited by

Blog

In the post

Date

neciudan.dev

What's the best way to do authentication in modern applications Read at the source ↗

4 Jul 2026

Links from this post

Link

Host

https://datatracker.ietf.org/doc/html/rfc7519

datatracker.ietf.org

https://paseto.io/

paseto.io

https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html

cheatsheetseries.owasp.org

https://www.youtube.com/watch?v=lEnbi4KClVw

youtube.com

https://auth0.com/docs/secure/security-guidance/data-security/token-storage

auth0.com

https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss

pragmaticwebsecurity.com

https://datatracker.ietf.org/doc/html/rfc6750

datatracker.ietf.org

https://oauth.net/about/introduction/

oauth.net

https://datatracker.ietf.org/doc/html/rfc1945

datatracker.ietf.org

https://www.youtube.com/watch?v=pYeekwv3vC4

youtube.com

https://speakerdeck.com/rdegges/jwts-suck

speakerdeck.com

https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

cheatsheetseries.owasp.org

https://github.com/expressjs/session/issues/176

github.com

https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html

cheatsheetseries.owasp.org

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

developer.mozilla.org

https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions

portswigger.net

https://github.com/vvo/iron-session?tab=readme-ov-file

github.com

https://portswigger.net/web-security/jwt

portswigger.net

https://cybercx.co.nz/blog/json-web-token-validation-bypass-in-auth0-authentication-api/

cybercx.co.nz

https://research.securitum.com/jwt-json-web-token-security/

research.securitum.com

https://redis.com/docs/json-web-tokens-jwts-are-not-safe/

redis.com

https://www.directdefense.com/csrf-in-the-age-of-json/

directdefense.com

https://www.rdegges.com/2018/please-stop-using-local-storage/

rdegges.com

https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/

auth0.com

http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/

cryto.net

http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-for-sessions-part-2-why-your-solution-doesnt-work/

cryto.net

New helper added: JWT Debugger – Decode, Debug and Validate JSON Web Tokens (JWT). Read at the source ↗

jwt.io