News for hackers. Stuff that matters.

A comment on Stop using JSON Web Tokens for user sessions. Parent comment

Re:Stop using JSON Web Tokens for user sessions by mort96 on Saturday November 25, 2023 @09:23AM (#38413705)
Cookies are sent with every request, including to every image or script file or style sheet etc etc. When sent as a separate header, you only set it to API requests.
[ Parent | on HN ]
Re:Stop using JSON Web Tokens for user sessions by mewpmewp2 on Sunday November 26, 2023 @07:29AM (#38421115)
You could use the Path prefix to only send to API endpoints where request has to be authenticated?

Or many usually have separate domain/subdomain names for API and static content in the first place.

I think having a separate prefix/subdomain would be generally good practice for defining scope which should be authed as well.

[ Parent | on HN ]