Is using JWT token for "remember me" less secure than random session token?

Question

I am after reading "https://stormpath.com/blog/token-auth-spa" and "https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence" (among others :-) ) and thing I would like to avoid is to use blindly every security measure I can think of just to feel more secure. Something like hashing a hash "just in case".

What I have now (the 3rd day of going through MEAN example) -- I have JWT token (id of the user) + expiration date. So the token won't live forever. This token is stored as a cookie in order to get "remember me" feature.

What bugs me here is lack of random data which server adds to the mix, so secure, no secure, but it is very deterministic setup (see the second article I linked).

So I wonder whether the JWT token is less secure than "classic" session token -- I am thinking about such setup:

• user logs in, JWT token is created as before, session token is created as well (id + random number), the hash of the random number is stored in DB (expiration date is set of course)
• for normal work JWT token is used (it is not used for "remember me")
• session token is used for "remember me", it is stored as a cookie

And when user returns, "remember me" kicks in, instead of logging in, cookie with session token is used to authorize user, on success, JWT is created.

So there would be three "layers":

• login + password -- infinite usage in time
• session token ("remember me") -- long term usage
• JWT token -- short term usage, just for current work

My question is -- is my first approach with sole JWT less secure or not? Or in other words -- is adding "session token" as I described above did I make this setup more secure or just make more mess? :-)

Answer 1

JWT, if hashed and encrypted strongly enough, are just as secure as sessions and bring lower overhead. Just make sure to keep it small(although if you're doing anything that requires more than a few KB of storage you're probably doing something wrong...). Follow the best practices for session with JWT and you'll be fine.

If you use a strong enough algorithm and a strong enough key then the user trying to crack it will be WAY out of luck. And if they do crack it then they also have to find a way to steal other people's JWT cookies to get that info(the same type of attack against a session).

If a JWT is less secure than a session, then you've designed it wrong because a JWT is a client sided session. Everything you would store in a session can be stored here. Heck you can even store a session id in it to keep track of larger things in the DB that wouldn't have a place in the JWT.

Answer 2

As Robert said, a jwt can be just as secure as a session if it is encrypted good. Make sure the secret you use is very unique.

WARNING: There is a vulnerability with some json web token libraries that use Asymmetric keys.

node-jsonwebtoken, pyjwt, namshi/jose, php-jwt or jsjwt with asymmetric keys (RS256, RS384, RS512, ES256, ES384, ES512). These are vulnerable libraries and to fix make sure you have the latest updates for them.

This website is very helpful on jwt education and testing: https://jwt.io/

This stack overflow answer explains asymmetric vs symmetric keys: https://stackoverflow.com/questions/32900998/jwt-keys-asymmetric-and-symmetric

This is what packages i use in my MEAN application. "jsonwebtoken": "^5.7.0", "passport-jwt": "^2.0.0"

passport.js is for authentication