3 ms·
Notice that they did not include JWT in this!
by yuhong 9y ago
Notice that they did not include JWT in this!
- CiPHPerCoder 9y agoJWT uses JWS, JWE, or both. Any criticism that targets JWE and JWS is necessarily relevant to JWT. The problems with JWT being addressed are in the domain of cryptography designs, so it's natural to criticize the cryptography components. The other problem with JWT is how people use it: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-for-sessions/ http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo...
- deleted 9y ago[deleted]
- yuhong 9y agoThe point however is that JWS/JWE is not as flawed as JWT is.
- CiPHPerCoder 9y agoYes it is. Most of the problems people point to with JWT exist in JWS or JWE.