On: Biscuit authorization

[grey-area]

A subset of JWTs sounds great given the previous security vulnerabilities found in JWTs and the huge surface area they give you:

https://www.akto.io/blog/jwt-none-algorithm-test

[robertlagrant → grey-area]

This is not a huge surface area. I don't know why this keeps coming up, but, while a silly default, is incredibly straightforward to not configure / remove / test for.

[grey-area → robertlagrant]

JWTs are definitely a much larger surface area than simpler encrypted sessions storage and most people don’t need that.

I cited this as one example of that surface area that led to serious vulnerabilities. Most people don’t need multiple ways to encrypt their data, and certainly not a ‘no encryption’ option. Each added option adds more ways to mess things up.