News for hackers. Stuff that matters.
Re:Stealing passwords from McDonald's users by gnud on Monday January 16, 2017 @11:42AM (#13411002)
It is an extra vuln. if the JWT only has the role=admin K/V, and no expiration value.

A jwt that is only valid for a certain time is no less secure than a session id, as long as you verify the signature correctly.

There are no comments on this comment yet.