News for hackers. Stuff that matters.
Re:Ten Years of JSON Web Token and Preparing for the Future by formerly_proven on Monday May 26, 2025 @04:39AM (#44095317)
> I don't know, what's the use-case? Server-server interaction? Then they still need to share a key to validate the JWT. And probably all but the user-facing server doesn't need to be exposed to public internet anyway so why the hoopla adding JWT?

JWTs across servers are typically used with signatures, not in HMAC mode (so no globally shared HMAC keys). Then the issuer simply exposes a JWKS endpoint for downstream consumers (so no additional maintenance to distribute public keys).

There are no comments on this comment yet.