Products · Product
JWT
Raised as a usability problem by 6 people on Hacker News over 9 years (2017–2025), in 6 threads.
People raised many different problems with JWT, but no single problem has yet been raised by 3 people in 3 different months and threads.
Unreviewed issues were grouped by machine: Claude Haiku labelled each comment as a usability complaint, named what it's about and summed up the problem in a line, and a small model grouped similar problems. Nobody has checked them by hand. Expect mistakes.
The newest 5 complaints
- Users can't get updated roles or access for up to five minutes after changes2025-05-26
- Users get logged out after going offline longer than the token expiry2024-05-29
- Easy for implementers to pick the 'none' algorithm and disable cryptography by mistake2021-07-30
- JWTs are very hard to use correctly, so developers get them wrong2020-05-27
- Easy to misuse; docs are scattered and assume existing domain knowledge2020-02-18