7 ms·
That’s only true of JWT if you allow your server to accept all algorithms. You don’t actually have to.
by abritinthebay 9y ago
That’s only true of JWT if you allow your server to accept all algorithms.
You don’t actually have to.
- rblatz 9y agoCorrect, your token authority should specify which algorithms are valid, and your clients should self configure via a secure back channel to only accept the algorithms your token authority issues.
- abritinthebay 9y agoExactly! JWT is a much misunderstood system it seems. Though it doesn’t exactly help itself by being quite complex