News for hackers. Stuff that matters.
Re:JSON Web Tokens should be avoided by batoure on Tuesday March 14, 2017 @01:12PM (#13869414)
Here is the use case that lead to the first implementation of JWT I was ever part of.

You have a single page webapp that uses two APIs for part of the application. For security reasons the APIs are zoned in such a way that neither of them can communicate with each other. The machine of the user sits in a zone where it can send HTTP requests to the zones of either API.

Now design a way to manage sessions across both APIs...

There are certainly a number of ways to accomplish this, but JWT was the cleanest and most performant.

There are no comments on this comment yet.