News for hackers. Stuff that matters.
Re:Why to not use JWT (2021) by zaphar on Thursday September 29, 2022 @10:17AM (#33020951)

    JWT is a token, often stored as a cookie.
This is both true and also misses the point. Session Cookies are ususally stateful. In other words, the server validates the session by querying a service or database. JWTs however are stateless. You don't query a service or database to validate the service. As a consequence if the JWT is not expired and is still using a valid key there is no out of the box way to invalidate the JWT. You can build custom invalidation measures on top of JWT but it's not a natural consequence of the design in the same way that a session cookie is.

There are no comments on this comment yet.