3 ms·
Correct, your token authority should specify which algorithms are valid, and your clients should self configure via a secure back channel to only accept the alg
by rblatz 9y ago
Correct, your token authority should specify which algorithms are valid, and your clients should self configure via a secure back channel to only accept the algorithms your token authority issues.
- abritinthebay 9y agoExactly! JWT is a much misunderstood system it seems. Though it doesn’t exactly help itself by being quite complex