Re:Why to not use JWT (2021)
by xorcist on Thursday September 29, 2022 @10:54AM
(#33021576)
You do need a cryptographically secure RNG to work with JWTs though. There's no getting around the need for randomness.
[ Parent
| on HN ]
You only need a cryptographically secure RNG to generate a key pair. Assuming asymetric keys. That private key can then be used to sign many many JWTS.
Whereas generating new session ids will always need fresh entropy.
That depends on the algorithm, some depend on randomness like IVs.
Maybe you are thinking of JWE?
If the signing of the JWT wasn’t deterministic, then it would be hard to verify.