4 ms·
With this method isn't the downside that you have to invalidate all tokens, and not just the attacker's tokens?
by zhobbs 8y ago
With this method isn't the downside that you have to invalidate all tokens, and not just the attacker's tokens?
- gammateam 8y agowhich isn't bad because all the processing is done client side anyway.
- merlincorey 8y ago> which isn't bad because all the processing is done client side anyway. I believe people are downvoting you because you may have overlooked the processing that must happen on the server to encode the token in the first place.