[the_sleaze9]

> what damage can that employee do in 5-10 minutes?

This is not an authentication issue (JWTs) this is a classic authorization issue (Permissions/Roles).

It's not the authentication layer's fault if you allow everyone root access.

JWTs are just fine. Bearer tokens are just fine. You can write shitty session code just as easily as shitty OAuth2 code.

[ehutch79]

To clarify, what I do for sso stuff, if I get the JWT, verify it, then generate a session_id to hand back to the frontend. I'm essentially using the JWT as a replacement for username/password when it comes from a sso provider. I can then do invalidation or deny login as normal.

[ehutch79]

You're absolutely right, but then we reach the, "why are you using JWTs?" part of things. if you're issuing them for your own service because that's what some guy on reddit said you should be doing...