News for hackers. Stuff that matters.

A comment on JWT should not be your default for sessions. Parent comment

Re:JWT should not be your default for sessions by SigmundA on Wednesday May 12, 2021 @09:48PM (#27137543)
Never trust the client, ever.
[ Parent | on HN ]
Re:JWT should not be your default for sessions by remram on Thursday May 13, 2021 @03:48PM (#27146498)
If that's how you feel, don't trust them to logout when they walk away. Make those sessions short-lived and ask for the password again whenever they do something remotely sensitive.
[ Parent | on HN ]
Re:JWT should not be your default for sessions by SigmundA on Thursday May 13, 2021 @04:11PM (#27146774)
If you trust the client then why sign the JWT?
[ Parent | on HN ]
Re:JWT should not be your default for sessions by remram on Friday May 14, 2021 @02:06PM (#27157613)
The opposite of "never trust the client" is not "always trust the client". Build yourself a model and find out where trust and security are required.
[ Parent | on HN ]