News for hackers. Stuff that matters.

A comment on JWT should not be your default for sessions. Parent comment

Re:JWT should not be your default for sessions by SigmundA on Thursday May 13, 2021 @04:11PM (#27146774)
If you trust the client then why sign the JWT?
[ Parent | on HN ]
Re:JWT should not be your default for sessions by remram on Friday May 14, 2021 @02:06PM (#27157613)
The opposite of "never trust the client" is not "always trust the client". Build yourself a model and find out where trust and security are required.
[ Parent | on HN ]