News for hackers. Stuff that matters.

A comment on Stop using JSON Web Tokens for user sessions. Parent comment

Re:Stop using JSON Web Tokens for user sessions by g-b-r on Saturday November 25, 2023 @11:32AM (#38414510)
Keep in mind that urls end up in logs, that might well not be so well protected
[ Parent | on HN ]
Re:Stop using JSON Web Tokens for user sessions by EE84M3i on Saturday November 25, 2023 @12:14PM (#38414783)
Particularly if you use cdns, tracing, analytics, etc.

Also, IIRC a parent frame can retrieve a child frame's current URL no matter what.

[ Parent | on HN ]
Re:Stop using JSON Web Tokens for user sessions by bob1029 on Saturday November 25, 2023 @02:14PM (#38415771)
In our case this is fine. The URL doesn't pass any claims. It is opaque client state bound to a specific identity which is validated by other means.
[ Parent | on HN ]