Stormpath, an authentication and user management service for developers, blogs about API design, JWT storage, security and its own engineering practices.
HN links its JWT storage post, which commenters cite for recommending HttpOnly secure cookies; the comments also include its hiring posts and a shutdown notice.
For traditional sessions:
1. All You Ever Wanted to Know About Sessions In Node.js (Stormpath) - https://stormpath.com/blog/everything-you-ever-wanted-to-know-about-node-dot-js-sessions
2. Express.js Production Best Practices - https://expressjs.com/en/advanced/best-practice-security.html
3. express-session (npm module) - https://ewiggin.gitbooks.io/expressjs-middleware/content/express-session.html
4. Node.js authentication strategy using Passport.js and Redis - https://blog.risingstack.com/node-hero-node-js-authentication-passport-js/
For JSON Web Tokens:
1. JWT Handbook: https://auth0.com/e-books/jwt-handbook
2. IETF Specification: https://tools.ietf.org/html/rfc7519
3. https://jwt.io/
4. Authentication in React Applications, Part 2: JSON Web Tokens - https://vladimirponomarev.com/blog/authentication-in-react-apps-jwt
6. Token Authentication Implementation - https://docs.docker.com/registry/spec/auth/jwt/
7. JWT Validation and Authorization in ASP.NET Core - https://blogs.msdn.microsoft.com/webdev/2017/04/06/jwt-validation-and-authorization-in-asp-net-core/
Stormpath (http://www.stormpath.com)
* We have roles open for core Java engineers, a Data Guru and a Developer Evangelist (Python, Ruby, PHP, Haskell...)
Stormpath is the first easy and secure user management and authentication service for developers. Fast and intuitive to use, it offers an easy API, open source SDKs, and an active community.By offloading user management and authentication to Stormpath, developers can bring new applications to market faster, reduce development and operations costs, and protect their users with best-in-class security.
We're well-funded, friendly and located in gorgeous downtown San Mateo near the Caltrain. Drop us a note if you think what APIs - even if there isn't a job listed that fits your bill. Jobs@stormpath.com
Stormpath | San Mateo, CA | full-time | onsite (or remote) | https://stormpath.com
We're hiring a developer evangelist (javascript) to come join my team and build open source security and authentication libraries! If you're interested in making it simpler to register users, log them in, and handle everything around user accounts and user data: this is the position for you! <3
You'll basically be doing stuff like:
* Giving tech talks at conferences, meetups, etc.
* Recording screencasts / videos, teach people how to do stuff.
* Writing educational articles about web security, best practices, etc.
* Working on open source software.
Hit me up directly if you want to chat! randall@stormpath.com
Stormpath | San Mateo, CA | https://stormpath.com | Full-time | Onsite
Position: Dev Ops Engineer
Stormpath is an authentication and user management service that helps developers quickly and securely build web and mobile applications.
Come join a team where you can have huge impact! We're looking for a versatile DevOps engineer to work primarily with Linux/AWS/Chef/Docker to support a Java environment.
We hire smart, fun, humble, and passionate people who love what they do and deliver quality work. We're trying to achieve something great, with great people.
Interested? Apply through our website or e-mail me directly: sarah@stormpath.com
I am using JWT for my projects to keep stateless sessions between servers and for some other
tokens (refresh, register, reset pass etc.). Of course extra security measures are required (MitM protection [HTTPS etc.], XSS / CSFR prevention etc.), but this has nothing to do with JWT. I use encryption with a frequently rotated private key to encrypt the part of the payload that only the server may read.
A good read at:
https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage
I consider cookies much more secure than the alternatives. Here's a detailed explanation as it relates to JWT. The main takeaway is, if properly configured by the site, cookies are more secure than alternatives like web storage.
https://stormpath.com/blog/where-to-store-your-jwts-cookies-vs-html5-web-storage
But that's coming from a site admin point of view. As a user, it would be great to have a browser plugin that allows me to reject cookies that aren't secure/httponly.