Re:Why to not use JWT (2021)
by zaphar on Thursday September 29, 2022 @10:17AM
(#33020951)
This is both true and also misses the point. Session Cookies are ususally stateful. In other words, the server validates the session by querying a service or database. JWTs however are stateless. You don't query a service or database to validate the service. As a consequence if the JWT is not expired and is still using a valid key there is no out of the box way to invalidate the JWT. You can build custom invalidation measures on top of JWT but it's not a natural consequence of the design in the same way that a session cookie is.
[ Parent
| on HN ]
There are no comments on this comment yet.