2 ms·

I just use sessions, backed by cookies. I find with JWTs you end up dealing with cookies in the end, because on browsers you're definitely going to want to per

by nickjj 9y ago

I just use sessions, backed by cookies. I find with JWTs you end up dealing with cookies in the end, because on browsers you're definitely going to want to persist the token in a cookie so the user can have access in between requests. Also, for the apps I develop, I often need to request the current user from a persisted database, so I'm doing a DB lookup on every request no matter what. Sure, I could cache this request in Redis but even on apps that have had to do this hundreds of thousands of times a month, it never caused any performance issues reading it directly from Postgres.

adamscybot 9y ago
"because on browsers you're definitely going to want to persist the token in a cookie so the user can have access in between requests." You'd usually just use localStorage for this purpose, not cookies. For your second point, you can store the info you need in the token itself, which is then signed so it can't be tampered with. Though yeh, sometimes, you just need the latest info in the DB. Depends on the use case.