#jwt

Kushal Das :python: :tor:In <a href="https://toots.dgplug.org/tags/rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#rust</a> / <a href="https://toots.dgplug.org/tags/rustlang" class="mention hashtag" rel="nofollow noopener" target="_blank">#rustlang</a> I have a <a href="https://toots.dgplug.org/tags/HTTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#HTTP</a> endpoint (<a href="https://toots.dgplug.org/tags/actix" class="mention hashtag" rel="nofollow noopener" target="_blank">#actix</a>) , where for a given query, it fetches <a href="https://toots.dgplug.org/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a> from the given parameter (URLS) and validates, puts some logic and returns the result. How to write unittest for this care in rust?

𝕂𝚞𝚋𝚒𝚔ℙ𝚒𝚡𝚎𝚕JWTs Are Not Session Tokens , Stop Using Them Like OneWhen JSON Web Tokens (JWTs) hit the mainstream, they were hailed as the solution to everything wrong with session management. Stateless! Compact! Tamper-proof! Suddenly, everyone started stuffing them into every web app like ketchup on bad code.🧑‍💻 <a href="https://archive.fo/01UkP" rel="nofollow noopener" translate="no" target="_blank">https://archive.fo/01UkP</a><a href="https://chaos.social/tags/json" class="mention hashtag" rel="nofollow noopener" target="_blank">#json</a> <a href="https://chaos.social/tags/jwt" class="mention hashtag" rel="nofollow noopener" target="_blank">#jwt</a> <a href="https://chaos.social/tags/webdev" class="mention hashtag" rel="nofollow noopener" target="_blank">#webdev</a> <a href="https://chaos.social/tags/token" class="mention hashtag" rel="nofollow noopener" target="_blank">#token</a> <a href="https://chaos.social/tags/web" class="mention hashtag" rel="nofollow noopener" target="_blank">#web</a> <a href="https://chaos.social/tags/code" class="mention hashtag" rel="nofollow noopener" target="_blank">#code</a> <a href="https://chaos.social/tags/bad" class="mention hashtag" rel="nofollow noopener" target="_blank">#bad</a> <a href="https://chaos.social/tags/badcode" class="mention hashtag" rel="nofollow noopener" target="_blank">#badcode</a> <a href="https://chaos.social/tags/WebTokens" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebTokens</a> <a href="https://chaos.social/tags/ketchup" class="mention hashtag" rel="nofollow noopener" target="_blank">#ketchup</a>

Kushal Das :python: :tor:Slowly moving the brain to play <a href="https://toots.dgplug.org/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a> <a href="https://toots.dgplug.org/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a> in the background. Next few weeks will be into the land of JWTs via both <a href="https://toots.dgplug.org/tags/rust" class="mention hashtag" rel="nofollow noopener" target="_blank">#rust</a> and <a href="https://toots.dgplug.org/tags/python" class="mention hashtag" rel="nofollow noopener" target="_blank">#python</a>.

Jobs for DevelopersSoundHound is hiring Senior Software Engineer🔧 <a href="https://mastodon.world/tags/java" class="mention hashtag" rel="nofollow noopener" target="_blank">#java</a> <a href="https://mastodon.world/tags/javascript" class="mention hashtag" rel="nofollow noopener" target="_blank">#javascript</a> <a href="https://mastodon.world/tags/typescript" class="mention hashtag" rel="nofollow noopener" target="_blank">#typescript</a> <a href="https://mastodon.world/tags/react" class="mention hashtag" rel="nofollow noopener" target="_blank">#react</a> <a href="https://mastodon.world/tags/springframework" class="mention hashtag" rel="nofollow noopener" target="_blank">#springframework</a> <a href="https://mastodon.world/tags/api" class="mention hashtag" rel="nofollow noopener" target="_blank">#api</a> <a href="https://mastodon.world/tags/hibernate" class="mention hashtag" rel="nofollow noopener" target="_blank">#hibernate</a> <a href="https://mastodon.world/tags/aws" class="mention hashtag" rel="nofollow noopener" target="_blank">#aws</a> <a href="https://mastodon.world/tags/azure" class="mention hashtag" rel="nofollow noopener" target="_blank">#azure</a> <a href="https://mastodon.world/tags/cicd" class="mention hashtag" rel="nofollow noopener" target="_blank">#cicd</a> <a href="https://mastodon.world/tags/docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#docker</a> <a href="https://mastodon.world/tags/gcp" class="mention hashtag" rel="nofollow noopener" target="_blank">#gcp</a> <a href="https://mastodon.world/tags/jwt" class="mention hashtag" rel="nofollow noopener" target="_blank">#jwt</a> <a href="https://mastodon.world/tags/kafka" class="mention hashtag" rel="nofollow noopener" target="_blank">#kafka</a> <a href="https://mastodon.world/tags/kubernetes" class="mention hashtag" rel="nofollow noopener" target="_blank">#kubernetes</a> <a href="https://mastodon.world/tags/mysql" class="mention hashtag" rel="nofollow noopener" target="_blank">#mysql</a> <a href="https://mastodon.world/tags/redis" class="mention hashtag" rel="nofollow noopener" target="_blank">#redis</a> <a href="https://mastodon.world/tags/seniorengineer" class="mention hashtag" rel="nofollow noopener" target="_blank">#seniorengineer</a> 🌎 Bengaluru, India ⏰ Full-time 🏢 SoundHoundJob details <a href="https://jobsfordevelopers.com/jobs/senior-software-engineer-at-soundhound-com-jun-9-2025-bb0adc?utm_source=mastodon.world&utm_medium=social&utm_campaign=posting" rel="nofollow noopener" translate="no" target="_blank">https://jobsfordevelopers.com/jobs/senior-software-engineer-at-soundhound-com-jun-9-2025-bb0adc?utm_source=mastodon.world&utm_medium=social&utm_campaign=posting</a> <a href="https://mastodon.world/tags/jobalert" class="mention hashtag" rel="nofollow noopener" target="_blank">#jobalert</a> <a href="https://mastodon.world/tags/jobsearch" class="mention hashtag" rel="nofollow noopener" target="_blank">#jobsearch</a> <a href="https://mastodon.world/tags/hiring" class="mention hashtag" rel="nofollow noopener" target="_blank">#hiring</a>

Sam Stepanyan :verified: 🐘<a href="https://infosec.exchange/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a>: 'Attacking JWT using X509 Certificates': how an attacker could sign the JWT token with their own private key and modify the header value to specify their public key for signature verification: <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#AppSec</a> <a href="https://infosec.exchange/tags/APIsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#APIsecurity</a><a href="https://trustedsec.com/blog/attacking-jwt-using-x509-certificates" rel="nofollow noopener" translate="no" target="_blank">https://trustedsec.com/blog/attacking-jwt-using-x509-certificates</a>

|7eter l-|. l3oling 🧰:ruby: Let's support kids.By "kids", I of course mean support for Key IDs (kids) in JWT assertions (IETF rfc7515 JSON Web Signature - JWS compliant)Of course, I also mean <a href="https://ruby.social/tags/FreePalestine" class="mention hashtag" rel="nofollow noopener" target="_blank">#FreePalestine</a>, and <a href="https://ruby.social/tags/SayNoToGenocide" class="mention hashtag" rel="nofollow noopener" target="_blank">#SayNoToGenocide</a>For a full writeup:<a href="https://dev.to/galtzo/ann-oauth2-v2012-w-support-for-kids-57be" rel="nofollow noopener" translate="no" target="_blank">https://dev.to/galtzo/ann-oauth2-v2012-w-support-for-kids-57be</a><a href="https://ruby.social/tags/Ruby" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ruby</a> <a href="https://ruby.social/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a> <a href="https://ruby.social/tags/Oauth2" class="mention hashtag" rel="nofollow noopener" target="_blank">#Oauth2</a>

Markus EiseleThe Curious Case of the Tampered Token <a href="https://myfear.substack.com/p/jwt-quarkus-murder-mystery" rel="nofollow noopener" translate="no" target="_blank">https://myfear.substack.com/p/jwt-quarkus-murder-mystery</a> <a href="https://mastodon.online/tags/Java" class="mention hashtag" rel="nofollow noopener" target="_blank">#Java</a> <a href="https://mastodon.online/tags/Quarkus" class="mention hashtag" rel="nofollow noopener" target="_blank">#Quarkus</a> <a href="https://mastodon.online/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a> <a href="https://mastodon.online/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://mastodon.online/tags/Microprofile" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microprofile</a>

Felix Palmen :freebsd: :c64:Good morning! ☕ Now that I can't find any other bugs in <a href="https://mastodon.bsd.cafe/tags/swad" class="mention hashtag" rel="nofollow noopener" target="_blank">#swad</a> any more, I'm thinking again about how I could improve it.Would anyone consider deploying it on a busy site right now? Either as a replacement for <a href="https://mastodon.bsd.cafe/tags/Anubis" class="mention hashtag" rel="nofollow noopener" target="_blank">#Anubis</a> (proof-of-work against bots), or for simple non-federated <a href="https://mastodon.bsd.cafe/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a>, or maybe even both?I'm currently not sure how well it would scale. The reason is the design with server-side sessions, which is simple and very light-weight "on the wire", but needs server-side RAM for each and every client. It's hard to guess how this would turn out on very busy sites.So, I'm thinking about moving to a stateless design. The obvious technical choice for that would be to issue a signed <a href="https://mastodon.bsd.cafe/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a> (Json Web Token), just like Anubis does it as well. This would have a few consequences though:* OpenSSL/LibreSSL would be a hard build dependency. Right now, it's only needed if the proof-of-work checker and/or TLS support is enabled. * You'd need an X509 certificate in any case to operate swad, even without TLS, just for signing the JWTs. * My current CSRF-protection would stop working (it's based on random tokens stored in the session). Probably not THAT bad, the login itself doesn't need it at all, and once logged in, the only action swad supports is logout, which then COULD be spoofed, but that's more an annoyance than a security threat... 🤔 * I would *still* need some server-side RAM for each and every client to implement the rate-limits for failed logins. At least, that's not as much RAM as currently.Any thoughts? Should I work on going (almost) "stateless"?

damienbodNew Microsoft docs: Configure JWT bearer authentication in ASP.NET Core<a href="https://learn.microsoft.com/aspnet/core/security/authentication/configure-jwt-bearer-authentication" rel="nofollow noopener" translate="no" target="_blank">https://learn.microsoft.com/aspnet/core/security/authentication/configure-jwt-bearer-authentication</a><a href="https://mastodon.social/tags/jwt" class="mention hashtag" rel="nofollow noopener" target="_blank">#jwt</a> <a href="https://mastodon.social/tags/aspnetcore" class="mention hashtag" rel="nofollow noopener" target="_blank">#aspnetcore</a> <a href="https://mastodon.social/tags/dotnet" class="mention hashtag" rel="nofollow noopener" target="_blank">#dotnet</a> <a href="https://mastodon.social/tags/oidc" class="mention hashtag" rel="nofollow noopener" target="_blank">#oidc</a> <a href="https://mastodon.social/tags/bearer" class="mention hashtag" rel="nofollow noopener" target="_blank">#bearer</a> <a href="https://mastodon.social/tags/authorization" class="mention hashtag" rel="nofollow noopener" target="_blank">#authorization</a> <a href="https://mastodon.social/tags/access" class="mention hashtag" rel="nofollow noopener" target="_blank">#access</a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a>Thanks Mike Kistler Rick Anderson Stephen Halter

d0rk ✅Never saw that before (until now) and I thought it was a somewhat funny oxymoron:A <a href="https://mastodon.social/tags/nonce" class="mention hashtag" rel="nofollow noopener" target="_blank">#nonce</a> claim in a <a href="https://mastodon.social/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a><a href="https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-token-claims#public-claims" rel="nofollow noopener" translate="no" target="_blank">https://auth0.com/docs/secure/tokens/json-web-tokens/json-web-token-claims#public-claims</a>

ONLYOFFICEGood news for <a href="https://fosstodon.org/tags/Alfresco" class="mention hashtag" rel="nofollow noopener" target="_blank">#Alfresco</a> users!The newest release of the <a href="https://fosstodon.org/tags/ONLYOFFICE" class="mention hashtag" rel="nofollow noopener" target="_blank">#ONLYOFFICE</a> connector for Alfresco introduces powerful features to work with <a href="https://fosstodon.org/tags/PDF" class="mention hashtag" rel="nofollow noopener" target="_blank">#PDF</a> files and create interactive fillable forms in PDF format: ✅ PDF editing and collaboration✅ PDF form creation✅ Default empty file templates✅ Default <a href="https://fosstodon.org/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a> token lifetime configuration ✅ Updated demo server address and moreRead our blog to learn more about this release: <a href="https://www.onlyoffice.com/blog/2025/01/onlyoffice-connector-for-alfresco-v8-0?utm_source=social&utm_medium=post&utm_campaign=fosstodon" rel="nofollow noopener" translate="no" target="_blank">https://www.onlyoffice.com/blog/2025/01/onlyoffice-connector-for-alfresco-v8-0?utm_source=social&utm_medium=post&utm_campaign=fosstodon</a>

Neil MaddenUpdated my Internet-Draft that deprecates <a href="https://infosec.exchange/tags/jose" class="mention hashtag" rel="nofollow noopener" target="_blank">#jose</a> <a href="https://infosec.exchange/tags/jwt" class="mention hashtag" rel="nofollow noopener" target="_blank">#jwt</a> “none” and “RSA1_5” algorithms. Added some guidelines for reviewers to ensure future algorithm registrations all have consistent (baseline) security goals.<a href="https://neilmadden.github.io/jose-deprecate-none-rsa1_5/draft-madden-jose-deprecate-none-rsa15.html#name-updated-review-instructions" rel="nofollow noopener" translate="no" target="_blank">https://neilmadden.github.io/jose-deprecate-none-rsa1_5/draft-madden-jose-deprecate-none-rsa15.html#name-updated-review-instructions</a>

gemma lynntoday was my last day at <a href="https://fedi.wondernetwork.com/@wonderproxy" class="u-url mention" rel="nofollow noopener" target="_blank">@wonderproxy</a>. last day working with <a href="https://phpc.social/@preinheimer" class="u-url mention" rel="nofollow noopener" target="_blank">@preinheimer</a> and <a href="https://glammr.us/@schmalliso" class="u-url mention" rel="nofollow noopener" target="_blank">@schmalliso</a> and <a href="https://mas.to/@tdriley" class="u-url mention" rel="nofollow noopener" target="_blank">@tdriley</a> and will (and puck, the new me!).it's been a pretty solid decade, folks. i have some FEELS. i learned <a href="https://bsd.network/tags/golang" class="mention hashtag" rel="nofollow noopener" target="_blank">#golang</a>, <a href="https://bsd.network/tags/reactjs" class="mention hashtag" rel="nofollow noopener" target="_blank">#reactjs</a>, <a href="https://bsd.network/tags/nodejs" class="mention hashtag" rel="nofollow noopener" target="_blank">#nodejs</a>, <a href="https://bsd.network/tags/selenium" class="mention hashtag" rel="nofollow noopener" target="_blank">#selenium</a>, <a href="https://bsd.network/tags/playwright" class="mention hashtag" rel="nofollow noopener" target="_blank">#playwright</a>, <a href="https://bsd.network/tags/puppet" class="mention hashtag" rel="nofollow noopener" target="_blank">#puppet</a>, <a href="https://bsd.network/tags/docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#docker</a>, <a href="https://bsd.network/tags/mongodb" class="mention hashtag" rel="nofollow noopener" target="_blank">#mongodb</a>, and how and why not to use <a href="https://bsd.network/tags/jwt" class="mention hashtag" rel="nofollow noopener" target="_blank">#jwt</a>'s. i keynoted <a href="https://bsd.network/tags/phptek" class="mention hashtag" rel="nofollow noopener" target="_blank">#phptek</a>, staffed a vendor booth at <a href="https://bsd.network/tags/saucecon" class="mention hashtag" rel="nofollow noopener" target="_blank">#saucecon</a>, and contributed (a very little bit) to my favorite <a href="https://bsd.network/tags/php" class="mention hashtag" rel="nofollow noopener" target="_blank">#php</a> framework.there is nothing in my adult life that has had as much of an impact on my career as the folks at wonderproxy. thanks for being awesome, wonderpeople. it's been a privilege working with you.

Neil MaddenComing soon. Too late to submit the I-D now due to pending IETF meeting, but will submit it when the datatracker re-opens.Deprecating alg:none and RSA PKCS#1 v1.5 encryption. <a href="https://neilmadden.github.io/jose-deprecate-none-rsa1_5/draft-madden-jose-deprecate-none-rsa15.html" rel="nofollow noopener" translate="no" target="_blank">https://neilmadden.github.io/jose-deprecate-none-rsa1_5/draft-madden-jose-deprecate-none-rsa15.html</a><a href="https://infosec.exchange/tags/jwt" class="mention hashtag" rel="nofollow noopener" target="_blank">#jwt</a> <a href="https://infosec.exchange/tags/jose" class="mention hashtag" rel="nofollow noopener" target="_blank">#jose</a> <a href="https://infosec.exchange/tags/cryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#cryptography</a>

Thomas BroyerAnd another one published simultaneously: Why are JWT?about why you don't actually want to add them to your application, and certainly not as a kind of session token<a href="https://blog.ltgt.net/jwt/" rel="nofollow noopener" translate="no" target="_blank">https://blog.ltgt.net/jwt/</a><a href="https://piaille.fr/tags/jwt" class="mention hashtag" rel="nofollow noopener" target="_blank">#jwt</a> <a href="https://piaille.fr/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://piaille.fr/tags/webdev" class="mention hashtag" rel="nofollow noopener" target="_blank">#webdev</a>

Recent searches

Search options

Administered by:

Server stats: