News for hackers. Stuff that matters.

A comment on Stop using JWT for sessions (2016). Parent comment

Re:Stop using JWT for sessions (2016) by bsamuels on Thursday November 01, 2018 @11:32AM (#18354901)
adding a database lookup is adding state
[ Parent | on HN ]
Re:Stop using JWT for sessions (2016) by manigandham on Thursday November 01, 2018 @11:36AM (#18354941)
The point is that JWTs are irrelevant to this discussion. How you pass data between client and server can be cookies, or another header. How you encode that data can be JWTs or your own format. It is not either/or.

Whether you manage state 100% on client or share it between client and server is an entirely separate topic.

[ Parent | on HN ]