News for hackers. Stuff that matters.

A comment on Ask HN: What's the current sentiment on JWT for stateless auth tokens?. Parent comment

Re:Ask HN: What's the current sentiment on JWT for stateless... by deathanatos on Friday December 13, 2019 @08:52PM (#21787270)
HTTP/2 HPACK compresses headers in such a way that the difference will be largely irrelevant.

Most connections nowadays are such that latency is overwhelmingly more important than that many bytes.

Also, IP address? You invalidate me every time I switch networks?

[ Parent | on HN ]
Re:Ask HN: What's the current sentiment on JWT for stateless... by vbezhenar on Saturday December 14, 2019 @11:47AM (#21790388)
Absolutely, if hacker steals token, he'll likely using another IP address, so token is bound to IP address, it's a very important security measure. It's easy to issue new token anyway and address does not change often.
[ Parent | on HN ]