News for hackers. Stuff that matters.

A comment on JSON Web Tokens should be avoided. Parent comment

Re:JSON Web Tokens should be avoided by StreamBright on Tuesday March 14, 2017 @05:03AM (#13866043)
Exactly. The session invalidation has to happen using a session store or expiry header or something similar. In this regard JWT is not better than cookies.
[ Parent | on HN ]
Re:JSON Web Tokens should be avoided by throwaway2016a on Tuesday March 14, 2017 @09:56AM (#13867478)
> expiry header

JWT tokens have the expiration date embedded in the token. There is no way to force it to expire like you you can with cookies.

Although force is a strong word. Even with cookies if you tell the client to delete a cookie it doesn't mean it has to listen.

[ Parent | on HN ]