News for hackers. Stuff that matters.
Re:Stop Using JWT for Sessions (2016) by tluyben2 on Sunday July 04, 2021 @04:26AM (#27728111)
> The JWT is stored in JS

Giving us, again and again, the same complaint received by every client since using react: refresh drops you to the login screen. It makes 'non computer' people extremely angry. So yeah, still have to store it in the browser.

And we are not alone: most companies that actually have clients that used to have this fixed it by now: don't break fundamental browser buttons, any of them.

Re:Stop Using JWT for Sessions (2016) by techn00 on Sunday July 04, 2021 @07:30AM (#27728892)
Azure does this but you're still "signed in", so all you have to do is click your account.