Re:Should I Use jwts For Authentication Tokens?
by jupp0r on Monday May 27, 2024 @03:42PM
(#40493913)
It's pretty rare in practice to be able to make authz decisions solely based on the information in JWT claims. Space in HTTP headers is limited and any moderately complex system will have a separate authz concept anyways that can be used to check for token invalidation.
[ Parent
| on HN ]
Re:Should I Use jwts For Authentication Tokens?
by hyperadvanced on Monday May 27, 2024 @04:58PM
(#40494640)
Exactly. Learned this the hard way. JWT is good for “this token is legit and has XYZ role or group”, and letting it go to the next layer. The next layer should do some addition checking that token has legit claims on modifying a resource or taking other actions, however that might be.