4 ms·
Cookies are implementation dependent. It's quite possible that a user agent doesn't honour what you instructed it to do regarding the expiration of a cookie. J
by nbevans 8y ago
Cookies are implementation dependent. It's quite possible that a user agent doesn't honour what you instructed it to do regarding the expiration of a cookie.
JWT however... your server side can validate its own token in whatever ways it wants (including expiration). You can't get more secure than that.
- icebraining 8y agoIf you checking the session on the server, you might as well just use a token in a cookie. The point of the JWT complexity is to avoid that.
- nbevans 8y agoJWT tokens being passed via cookies is a valid use case.