News for hackers. Stuff that matters.
Re:Use cookies and sessions (not JWTs) for authentication by bayesian_horse on Monday January 16, 2023 @04:50AM (#34398796)
JWT is nothing but a signed JSON. You only sign it because you need some entity to trust it without asking another server. If you need to ask another server, you don't need JWT. And that's what the Django session store is doing. The data isn't stored on the client side.

Another option is a signed or encrypted cookie containing whatever you want it to store. That is similar to a session store but stored on the client side and quite limited in size. Again, that's not really JWT, but you may use a JWT as a cookie if you have to. But JWT isn't encrypted (by default).

Re:Use cookies and sessions (not JWTs) for authentication by scrollaway on Monday January 16, 2023 @04:54AM (#34398822)
I understand what JWT is and I also don’t think it makes much sense to use them in a situation where you’re going to store them as is in the db. I’m just giving an example of what it could bring to the table if you did. Devils advocate and all.