4 ms·
>Do you have users? Do those users need to log in? Well, you now have access tokens related to users. Aren't those tokens supposed to be stored client side any
by 43224gg252 9y ago
>Do you have users? Do those users need to log in? Well, you now have access tokens related to users.
Aren't those tokens supposed to be stored client side anyway? Aren't those tokens supposed to contain encoded information about the user that you decode server side? Why would you store the users token to begin with?
- STRML 9y agoThat's a matter of opinion and implementation. Not everyone uses JWTs. What if you want to invalidate all logged-in tokens for a user? You either need to store a blacklist (that's a relation) or set extremely short expiry times.
- ZephyrP 9y agoi think he is discussing standard cookie session ids here, not access tokens. in many web applications, all the information you need is stored within that token and signed by a server-side secret.
- pritambaral 9y agoSame thing. How do you invalidate a signed cookie?