Re:JWT vs. Opaque Tokens
by gboone on Thursday September 29, 2022 @09:01AM
(#33019986)
Maybe it's about "can get" vs "should be allowed to get"? They can carry whatever so it's technically true, right?
[ Parent
| on HN ]
It was more about the
and use it in another without those servers needing to consult a central service.
part. Unless you take care of key distribution yourself (like another poster wrote), this consultation of a central service has to take place to exchange key information (but not for additional authentication or authorization information).