News for hackers. Stuff that matters.

A comment on Ask HN: What do you use for authentication and authorization?. Parent comment

Re:Ask HN: What do you use for authentication and authorizat... by ynniv on Thursday December 27, 2018 @12:20PM (#18770863)
You can sign session ids to prevent DoS, and you can cache session ids to avoid database lookups, but you can't detect forged or stolen JWT tokens.
[ Parent | on HN ]
Re:Ask HN: What do you use for authentication and authorizat... by nmgsd on Saturday December 29, 2018 @12:22PM (#18784596)
You can't forge a JWT without stealing the private key of the valid JWT signer.

You can steal a JWT token the same way you can steal a session token.

[ Parent | on HN ]