4 ms·
I use JWT for authentication on my current project. And I eventually ended up having to check the user's 'role' in the database for authorization before I let
by jcadam 8y ago
I use JWT for authentication on my current project. And I eventually ended up having to check the user's 'role' in the database for authorization before I let them do anything anyway (and consequently, revoking someone's user role or suspending their account has immediate effect).
I saw many examples on the net of people putting role/authorization and various other types of session information within the JWT and it just looked insane to me.
Ultimately, I think what I ended up with is only a minor win over just generating random tokens and maintaining a "sessions" table. Probably not worth the effort and likely won't use JWT again.
- wheresvic1 8y ago> I saw many examples on the net of people putting role/authorization and various other types of session information within the JWT and it just looked insane to me. Why is this crazy? If you encrypt your JWT with a private key that is only known to the server, then any modification to the JWT will lead to an invalid token. The only thing here is that the list of roles granted is visible to the user if they were to decode the JWT, which is something you might not be entirely comfortable with but I don't think it's totally crazy.
- jcadam 8y agoI suppose it depends on the application. I wanted to be able to revoke a user's permissions and not have to wait until token expiration for them to be locked out.