Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on JWT should not be your default for sessions. Parent comment
Yes.
> Like, what is the worst that is gonna happen in a five minute window between logout and the token expiring?
Complete compromise of your reddit account.
> But every read request for a normal user? You are telling me that those all need to re-verify every request?
For information that is not public, yes.
> JWT is pretty rad, honestly.
In the eyes of an attacker, absolutely.
There are no comments on this comment yet.
Yes.
> Like, what is the worst that is gonna happen in a five minute window between logout and the token expiring?
Complete compromise of your reddit account.
> But every read request for a normal user? You are telling me that those all need to re-verify every request?
For information that is not public, yes.
> JWT is pretty rad, honestly.
In the eyes of an attacker, absolutely.