News for hackers. Stuff that matters.

A comment on JWT should not be your default for sessions. Parent comment

Re:JWT should not be your default for sessions by tatersolid on Thursday May 13, 2021 @11:46PM (#27150479)
So you have todo a DB call to get this key on every page load or API request?

You’re back to square one. Just use an opaque random session ID

[ Parent | on HN ]
Re:JWT should not be your default for sessions by whateveracct on Friday May 14, 2021 @01:51AM (#27151170)
I do those anyways - from my user table. But I don't have some extra table of sessions that is append-only (modulo expiration). Cuts out an entire system.
[ Parent | on HN ]