4 ms·
> Unless you work on a Reddit-scale application, there's no reason to be using JWT tokens as a session mechanism. And what should I use when I do work on a Red
by arendtio 8y ago
> Unless you work on a Reddit-scale application, there's no reason to be using JWT tokens as a session mechanism.
And what should I use when I do work on a Reddit-scale application?
- captn3m0 8y agohttps://paseto.io/ https://paseto.io/ >>Paseto is everything you love about JOSE (JWT, JWE, JWS) without any of the many design deficits that plague the JOSE standards.
- KirinDave 8y agoMacaroons. JWTs are a total nightmare from a security perspective in an organization trying to provide a microservice environment. There are way too many potential mistakes permissible in JWTs spec. They nearly always come up when you're stretching across a pair of language environments and a few library versions.