News for hackers. Stuff that matters.

A comment on JSON Web Tokens should be avoided. Parent comment

Re:JSON Web Tokens should be avoided by couchand on Tuesday March 14, 2017 @01:01PM (#13869278)
> The alternative is to store a UUID for each user

Is that not effectively a server-side session?

[ Parent | on HN ]
Re:JSON Web Tokens should be avoided by Alex3917 on Tuesday March 14, 2017 @01:06PM (#13869341)
> Is that not effectively a server-side session?

With most web frameworks (e.g. Django), the user model is retrieved on every request anyway. So it would be perhaps more accurate to say that it's a server-side session that's effectively not a server-side session, since no additional lookups are needed, only the user model lookup that's already done anyway.

[ Parent | on HN ]