JWT should not be your default for sessions

Re:JWT should not be your default for sessions by whateveracct on Wednesday May 12, 2021 @11:10PM (#27138006)

It's per-user. Just a column with all their other stuff.

Sessions:Users are Many:1 typically so that's not as simple

[ Parent | on HN ]

Re:JWT should not be your default for sessions by tatersolid on Thursday May 13, 2021 @11:46PM (#27150479)

So you have todo a DB call to get this key on every page load or API request?

You’re back to square one. Just use an opaque random session ID

[ Parent | on HN ]

Re:JWT should not be your default for sessions by whateveracct on Friday May 14, 2021 @01:51AM (#27151170)

I do those anyways - from my user table. But I don't have some extra table of sessions that is append-only (modulo expiration). Cuts out an entire system.

[ Parent | on HN ]