News for hackers. Stuff that matters.

A comment on JWT should not be your default for sessions. Parent comment

Re:JWT should not be your default for sessions by IgorPartola on Wednesday May 12, 2021 @10:22PM (#27137731)
I guess because if you have the JWT abs I have your JWT and you hit logout, I can keep using your JWT.
[ Parent | on HN ]
Re:JWT should not be your default for sessions by lbriner on Thursday May 13, 2021 @03:32AM (#27139395)
I think they are saying that to get that JWT would not be easy or likely, since it would need to be used within 5 minutes as well.

Although unlikely, I guess people want to know that clicking logout just does that and that there isn't a chance that some kind of hacker, colleague, nerfarious company or country couldn't continue to use your apps as you.

[ Parent | on HN ]