News for hackers. Stuff that matters.
Re:Stop using JWT for sessions (2016) by the_af on Thursday November 01, 2018 @02:40PM (#18357049)
Yes, the battle-tested argument becomes moot when enough time passes and there's enough adoption. This doesn't make the original argument invalid, though -- just unheeded! ;) It seems we software devs are doomed to reinvent the wheel, again, and again, and again.

As for session cookies: like the author says, cookies are a storage medium and orthogonal to the issue. You can have all the problems of JWTs in addition to all the problems of cookies.

There are no comments on this comment yet.