News for hackers. Stuff that matters.
Re:Ask HN: What's the current sentiment on JWT for stateless... by abathur on Friday December 13, 2019 @03:02PM (#21784856)
While I haven't taken the leap to using a JWT in any of these cases yet and am a little bearish on them, I do also feel like the baby goes out with the bath-water, here.

Nothing about adopting JWT says you can't still use a full auth check for state-changing endpoints, and use a stateless session to shave some evaluation time off of frequent read-only requests for data that isn't terribly sensitive.

You probably shouldn't do it lightly or prematurely since it makes it harder to reason about authentication, but I think it's worth considering whenever you're optimizing.

There are no comments on this comment yet.