TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

JWT scope claim compression using a bitmap

40 点作者 rmedaer大约 5 年前

11 条评论

sonofgod大约 5 年前
That&#x27;s a great garden path sentence. (or at least beautifuly ambiguous)<p>I initally parsed it as &quot;[The] James Webb Telescope ([which is a tele]scope) [team] claim [they can] compress [pictures somehow] using a bitmap&quot;.
评论 #23283483 未加载
评论 #23283318 未加载
shoo大约 5 年前
As a casual reader not familiar with problem of large JWT scopes, I suggest the strength of the argument for this proposal could be improved by explaining exactly why larger JWT tokens cause problems in practice, defining some metrics or benchmarks that can be used to measure the impact of the problem, then comparing the proposed solution to the baseline approach using those metrics.<p>E.g. are large JWT tokens bad because they take longer to send? Then compare durations between both implementations. Or are large JWT tokens bad because they exceed some maximum supported token size? Then compare how many scopes are supported by the standard approach and new approach before hitting limit.<p>Another thought: the proposed compression scheme requires that each token producer &amp; consumer needs to depend upon a centralised scope list that defines the single source of truth of which scope is associated with which index for all scopes in the ecosystem.<p>If we assume we&#x27;ve set that up, why not generalise and say the centralised shared scope list is actually a centralised JWT compression standard that defines how to compress and decompress the entire JWT.<p>This could be implemented as something like <a href="https:&#x2F;&#x2F;facebook.github.io&#x2F;zstd&#x2F;" rel="nofollow">https:&#x2F;&#x2F;facebook.github.io&#x2F;zstd&#x2F;</a> running in dictionary compression mode, where a custom compression dictionary is created that is good at compressing the expected distribution of possible JWT values. As long as each JWT producer and consumer is using the same version of the centrally managed compression dictionary the compression &amp; decompression could still occur locally.<p>In practise in any given JWT ecosystem perhaps there&#x27;s a subset of scopes that commonly appear together. If common enough that entire subset of common scopes could be encoded in 1 or 0 bits using a custom compression scheme tuned to the frequency of observed JWT scopes, instead of compressing each scope independently.
评论 #23285755 未加载
评论 #23281863 未加载
评论 #23283001 未加载
评论 #23282034 未加载
tyingq大约 5 年前
I wonder if this is much smaller than using one character claims and regular http transport deflate&#x2F;gzip compression.
评论 #23281734 未加载
评论 #23281708 未加载
tehbeard大约 5 年前
&gt; Your resources (aka content) ACL should not be in the scope itself<p>I have to disagree on this one, being able to specify which resources an OAuth client can tinker with is useful (e.g. only read access to x,y and z repos).<p>I&#x27;m also curious on how often these use cases are of needing many scopes &#x2F; a god JWT, vs. production usage and keeping a narrow scope for the task at hand. There&#x27;s also the other option (if in charge of authoring the resource server) to have broader scopes that encompass several others.
评论 #23283311 未加载
tlarkworthy大约 5 年前
The access token is designed for saving size. Scopes are in the ID token. The disadvantage of the access token is the required back channel. But then this scheme also needs a shared backchannel so it&#x27;s pretty much an access token implementation (you could express it as such)<p><a href="https:&#x2F;&#x2F;developer.okta.com&#x2F;docs&#x2F;guides&#x2F;validate-id-tokens&#x2F;overview&#x2F;" rel="nofollow">https:&#x2F;&#x2F;developer.okta.com&#x2F;docs&#x2F;guides&#x2F;validate-id-tokens&#x2F;ov...</a>
cafxx大约 5 年前
How about side-stepping the problem of big lists of scopes by training a zlib or zstd dictionary with the list of scopes, and then compressing the scopes in the jwt token using this dictionary?<p>Obvious benefit is that you can still represent a scope that is not included in the ones used to train the dictionary (vs. the proposed approach that breaks down in this case)
abhishektwr大约 5 年前
I am curious, why will you not use OAuth 2 userinfo endpoint which can serve a lot more detail and keep claims in JWT simpler and lightweight.
评论 #23283386 未加载
quaffapint大约 5 年前
Should http&#x2F;2 header compression not take care of the JWT size to the point that would make this more work than it&#x27;s worth?
评论 #23284407 未加载
amaccuish大约 5 年前
This very similar to SID compression in Windows Kerberos. Funny to see the same challenges and problems in the web space.
compassionate大约 5 年前
I would like to see a standardized scopes composer tool to complement this.
Ken_Adler大约 5 年前
I commend you for the attempt...<p>But the issue you are trying to mitigate (heavy tokens due to complex scope strategy) is a symptom of a bigger problem that has caused OAuth-using folks to scratch their heads for a long while. (of course, also realtes to non-Oauth JWTs)<p>Tldr: The new &quot;Cloud native&quot; way of solving for this is to not push your &quot;Permissions&quot; thru the token.<p>Basically, you limit the scopes included in a token to just a few basic ones (essentially assigning the user to a &quot;Role&quot; - think RBAC)....<p>... and then you use a modern Authorization approach (e.g. CNCF Open Policy Agent) to implement the detailed&#x2F;fine grain authorization.<p>Its hella cool, declarative, distributed, and infinitely scalable...<p>... and it obviates the whole &quot;heavy JWT&quot; issue before it starts....<p>Source: This is what I do day in day out in my day job....
评论 #23287265 未加载