3 ms·
Now add in JWT and CSRF tokens and the payload size per request adds up even more. It's just turtles all the way.
by superasn 8y ago
Now add in JWT and CSRF tokens and the payload size per request adds up even more. It's just turtles all the way.
- pas 8y agoWhy do you need JWT and CSRF at the same time? If you have the JWT you can use that as the CSRF token.
- superasn 8y agoI don't think that you can. The CSRF token must either be in the headers or the meta tags. Storing it inside the JWT cookie would defeat the purpose (unless you are not using cookies at all in which case you don't have to).
- bosyr 8y agoJWT don’t have to be in a cookie. It may very well be a bearer token in the Authorization header as well. I would assume that is the most common use of a JWT, but that is just an assumption.