I am after reading "https://stormpath.com/blog/token-auth-spa" and "https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence" (among others :-) ) and thing I would like to avoid is to use blindly every security measure I can think of just to feel more secure. Something like hashing a hash "just in case".
What I have now (the 3rd day of going through MEAN example) -- I have JWT token (id of the user) + expiration date. So the token won't live forever. This token is stored as a cookie in order to get "remember me" feature.
What bugs me here is lack of random data which server adds to the mix, so secure, no secure, but it is very deterministic setup (see the second article I linked).
So I wonder whether the JWT token is less secure than "classic" session token -- I am thinking about such setup:
- user logs in, JWT token is created as before, session token is created as well (id + random number), the hash of the random number is stored in DB (expiration date is set of course)
- for normal work JWT token is used (it is not used for "remember me")
- session token is used for "remember me", it is stored as a cookie
And when user returns, "remember me" kicks in, instead of logging in, cookie with session token is used to authorize user, on success, JWT is created.
So there would be three "layers":
- login + password -- infinite usage in time
- session token ("remember me") -- long term usage
- JWT token -- short term usage, just for current work
My question is -- is my first approach with sole JWT less secure or not? Or in other words -- is adding "session token" as I described above did I make this setup more secure or just make more mess? :-)