News for hackers. Stuff that matters.

A comment on JWT should not be your default for sessions. Parent comment

Re:JWT should not be your default for sessions by jfgiogktkt on Wednesday May 12, 2021 @10:05PM (#27137644)
What's the advantage over storing it just in the cookie then, since you need to look at it anyway, and since the localstorage storage half is useless on it's own (thus not useful from JS)?
[ Parent | on HN ]
Re:JWT should not be your default for sessions by hmsimha on Wednesday May 12, 2021 @10:32PM (#27137796)
You're limited in how much data you can store in a cookie
[ Parent | on HN ]
Re:JWT should not be your default for sessions by solitus on Thursday May 13, 2021 @11:14AM (#27143014)
Your front-end probably does not need to know about the signature which is the part you leave in an HTTP only cookie.
[ Parent | on HN ]