philenius / philenius.github.io Goto Github PK

I couldn't find a way to add comments to your blog post so I'll raise the issue here:

This article is well explained as far as it goes. But I don't believe it is complete.

The approach does not handle session management. Sessions should not be infinite and JWT's are subject to hijack attacks (they should have short lifespans in minutes not hours or days to limit this issue).

Therefore, for a web app that does most things over websockets, you also have to handle ongoing comms via ws and ws only allows the Bearer header on initial connection AFAIK, not in the ws comms.

You still need to pass the JWT in ws msg's and the server needs to do ongoing validation of both the JWT and the session.

Without that, you have (like virtually all other similar posts on the Internet) presented something that appears to be secure but actually is not.