4 ms·
> I saw many examples on the net of people putting role/authorization and various other types of session information within the JWT and it just looked insane to
by wheresvic1 8y ago
> I saw many examples on the net of people putting role/authorization and various other types of session information within the JWT and it just looked insane to me.
Why is this crazy? If you encrypt your JWT with a private key that is only known to the server, then any modification to the JWT will lead to an invalid token.
The only thing here is that the list of roles granted is visible to the user if they were to decode the JWT, which is something you might not be entirely comfortable with but I don't think it's totally crazy.
- jcadam 8y agoI suppose it depends on the application. I wanted to be able to revoke a user's permissions and not have to wait until token expiration for them to be locked out.