Stop using JWT for sessions (2016)

Re:Stop using JWT for sessions (2016) by rusk on Thursday November 01, 2018 @11:46AM (#18355101)

Oh I'm not aware of the means of using JWT you describe. I think the context of this article is using JWT exclusively, and by the looks of things plenty of people are doing just that.

[ Parent | on HN ]

Re:Stop using JWT for sessions (2016) by 0xffff2 on Thursday November 01, 2018 @03:40PM (#18357664)

The article specifically addresses the confusion that you're exhibiting:

>A lot of people mistakenly try to compare "cookies vs. JWT". This comparison makes no sense at all, and it's comparing apples to oranges - cookies are a storage mechanism, whereas JWT tokens are cryptographically signed tokens.

There's no such thing as "JWT exclusively". The JWT is just a chunk of data; it has to be stored somewhere, either in a cookie or in local storage.

[ Parent | on HN ]

Re:Stop using JWT for sessions (2016) by rusk on Friday November 02, 2018 @04:28AM (#18361427)

I’m not too sure what you’re talking about but the article is about this confusion.

[ Parent | on HN ]