4 ms·
JWT is often used as an implementation of signed cookies. Also, don't use signed cookies unless you have a crypto expert on staff.
by CiPHPerCoder 10y ago
JWT is often used as an implementation of signed cookies.
Also, don't use signed cookies unless you have a crypto expert on staff.
- spriggan3 10y ago> Also, don't use signed cookies unless you have a crypto expert on staff. As opposed to what ? re-implementing cookies from scratch with JWT ? JWT is a dangerous system because it's even harder to get things right. Cookies and their flaws have been documented for decades, no need to be a crypto expert to sign cookies.
- CiPHPerCoder 10y ago> no need to be a crypto expert to sign cookies You literally just said the equivalent of "no need to be a crypto expert to implement cryptographic signatures." Please don't do that without a crypto expert on staff. They'll be able to avoid side channels that non-experts will never even imagine. To wit: http://blog.ircmaxell.com/2014/11/its-all-about-time.html http://blog.ircmaxell.com/2014/11/its-all-about-time.html It's just a bad idea all around.