News for hackers. Stuff that matters.

A comment on Stop using JWT for sessions (2016). Parent comment

Re:Stop using JWT for sessions (2016) by zhobbs on Thursday November 01, 2018 @10:34AM (#18354223)
With this method isn't the downside that you have to invalidate all tokens, and not just the attacker's tokens?
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by gammateam on Thursday November 01, 2018 @11:17AM (#18354722)
which isn't bad because all the processing is done client side anyway.
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by merlincorey on Thursday November 01, 2018 @12:08PM (#18355377)
> which isn't bad because all the processing is done client side anyway.

I believe people are downvoting you because you may have overlooked the processing that must happen on the server to encode the token in the first place.

[ Parent | on HN ]