News for hackers. Stuff that matters.

A comment on Stop using JWT for sessions (2016). Parent comment

Re:Stop using JWT for sessions (2016) by tehlike on Thursday November 01, 2018 @10:38AM (#18354251)
Yes, of course, jwt can facilitate that. Using it as a replacement is not good, i agree.
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by jrochkind1 on Thursday November 01, 2018 @11:00AM (#18354508)
But what value is it adding over ordinary 'bearer token' sessions in that case?
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by Spivak on Thursday November 01, 2018 @01:39PM (#18356425)
When you aren't invalidating tokens your app server can serve all static but restricted content without checking with the DB.
[ Parent | on HN ]