4 ms·
You can sign session ids to prevent DoS, and you can cache session ids to avoid database lookups, but you can't detect forged or stolen JWT tokens.
by ynniv 8y ago
You can sign session ids to prevent DoS, and you can cache session ids to avoid database lookups, but you can't detect forged or stolen JWT tokens.
- nmgsd 8y agoYou can't forge a JWT without stealing the private key of the valid JWT signer. You can steal a JWT token the same way you can steal a session token.
- deleted 8y ago[deleted]