News for hackers. Stuff that matters.

A comment on JWT should not be your default for sessions. Parent comment

Re:JWT should not be your default for sessions by jfgiogktkt on Wednesday May 12, 2021 @10:00PM (#27137615)
You logout on a public computer, the next user undeletes the cookie (which is just a row in a profile SQLite database).
[ Parent | on HN ]
Re:JWT should not be your default for sessions by remram on Thursday May 13, 2021 @03:24PM (#27146231)
Couldn't the previous user have rigged the app to not send the logout request, or way more plausibly installed a keylogger to get your password, which allows them to log in again at will?

I'm not disagreeing with you, it just seems to only cover a very specific type of attack, if someone else can mess with software. And of course if they can't it is unnecessary.

[ Parent | on HN ]