Re:JWT should not be your default for sessions
by ryan-allen on Monday May 17, 2021 @03:50AM
(#27180988)
> JWT is awesome.
That's generally my thought, too. In my career the authentication sophistication was always a trade off (effort vs security) based on how paranoid the org felt about certain things.
Having worked on PHP/Rails/.NET Webforms/Node.js apis/C# webapis the session management techniques are all very different.
Having run high traffic websites also, the ability to offload logged-in sessions into JWT was really, really nice. Not having to prune auto-generated sessions from disk of PHP applications is a nice thing to not worry about.
That's generally my thought, too. In my career the authentication sophistication was always a trade off (effort vs security) based on how paranoid the org felt about certain things.
Having worked on PHP/Rails/.NET Webforms/Node.js apis/C# webapis the session management techniques are all very different.
Having run high traffic websites also, the ability to offload logged-in sessions into JWT was really, really nice. Not having to prune auto-generated sessions from disk of PHP applications is a nice thing to not worry about.