News for hackers. Stuff that matters.

A comment on Why to not use JWT (2021). Parent comment

Re:Why to not use JWT (2021) by quesera on Thursday September 29, 2022 @10:55AM (#33021592)
Exactly. JWTs assert claims.

If your claim is not durable enough for the protocol's expiration setting (e.g. authorization, in some cases), then don't abuse JWTs. Simple!

[ Parent | on HN ]
Re:Why to not use JWT (2021) by eagsalazar2 on Thursday September 29, 2022 @11:56AM (#33022455)
This is really nice way of putting this. Logging in/out is authorization (and authn) so generally if you want to revoke access (log people out), JWTs are possibly the wrong choice (the thing people use JWTs for 99% of the time)
[ Parent | on HN ]