4 ms·

So, if I'm reading the advice right, then ... * Using JWT for authorization, particularly for one-time use == GOOD * Using JWT to represent long-lived pers

So, if I'm reading the advice right, then ... * Using JWT for authorization, particularly for one-time use == GOOD * Using JWT to represent long-lived persistent session state == BAD and, always transmit your tokens in all directions over HTTPS. This seems like useful advice given all the reasons put forward. Do I understand correctly or did I miss anything?

CiPHPerCoder 10y ago
That's it in a nutshell. A lot of developers also misuse JWT in strange ways, and the meat of this article was responding to those weird/unsafe use-cases.
- dabernathy89 10y ago
  Haven't used JWTs myself, but whenever I read an article or tutorial about them, it's always in the context of replacing session cookies.
joepie91_ 10y ago
That's pretty much a perfect summary, yeah.
mstade 10y ago
Yeah, pretty much. JWT is a very good and useful spec, I think particularly in distributed systems, but it's no panacea.