3 ms·
JWT is especially useful for validating requests in a microservice architecture. You can pass around the token an embed roles in them. No need to keep a session
by hharnisch 10y ago
JWT is especially useful for validating requests in a microservice architecture. You can pass around the token an embed roles in them. No need to keep a session store with them!
- hharnisch 10y agoOn another note I've been working on a service that generates expirable/refreshable JWTs. Its a good way to start trying them out https://github.com/hharnisc/auth-service https://github.com/hharnisc/auth-service
- joepie91_ 10y agoBetter remove that again. It is extremely dangerous to store any kind of credential in Local Storage. Cookies are the (only) correct place for storing credentials.
- areed 10y agoBecause you can set Secure and HttpOnly flags on cookies? This merely brings them up to the same level of security you get with Local Storage. http://blog.portswigger.net/2016/05/web-storage-lesser-evil-for-session.html http://blog.portswigger.net/2016/05/web-storage-lesser-evil-...
- pags 10y agoWhat is a "level" of security? If I'm able to inject arbitrary code into your page, with it I can access your local storage data, but I can't access your "http only" cookies - so there's at least some "level" of difference.
- garfij 10y agoIf you're at the point where someone can inject random code into your site, you've already lost and have so many more problems than access to localStorage.