3 ms·
I suspect it's mostly cargo-cult thing. JWT itself, however, is a signed-JSON format with detached signature which is very useful well beyond access token use-
by donpark 10y ago
I suspect it's mostly cargo-cult thing.
JWT itself, however, is a signed-JSON format with detached signature which is very useful well beyond access token use-case.
JWT as access token at large scale will require frequent key rotation so inability to revoke becomes a problem but it's not a show stopper because one can work around it using various tactics such as bloom filter I mentioned above.