Stop using JWT for sessions (2016)

Re:Stop using JWT for sessions (2016) by lvh on Thursday November 01, 2018 @10:33AM (#18354211)

So you're saying you can have sane sessions as long as you have some server-side storage? :-)

[ Parent | on HN ]

Re:Stop using JWT for sessions (2016) by tehlike on Thursday November 01, 2018 @10:38AM (#18354251)

Yes, of course, jwt can facilitate that. Using it as a replacement is not good, i agree.

[ Parent | on HN ]

Re:Stop using JWT for sessions (2016) by jrochkind1 on Thursday November 01, 2018 @11:00AM (#18354508)

But what value is it adding over ordinary 'bearer token' sessions in that case?

[ Parent | on HN ]

Re:Stop using JWT for sessions (2016) by Spivak on Thursday November 01, 2018 @01:39PM (#18356425)

When you aren't invalidating tokens your app server can serve all static but restricted content without checking with the DB.

[ Parent | on HN ]