4 ms·
False dilemma. Why not JWT inside a session cookie? Benefit: retain horizontal scaling capabilities, don't have to use local storage.
by alephnan 7y ago
False dilemma. Why not JWT inside a session cookie?
Benefit: retain horizontal scaling capabilities, don't have to use local storage.
- ehutch79 7y agoTo be fair, 90% of the time i see people recommend JWT for auth, it's a session token inside a jwt in a cookie, which then gets decoded and checked against the db in the backend
- rdegges 7y agoI'm the original author. There are several reasons: - The cookie payload if you're using stateless JWTs will often be > 4kb, meaning you can't store the JWT in a cookie. - You get no benefit from doing it this way since it is more complex to use JWTs than plain old session cookies. - You will still need centralization regardless if you want to support token revocation.
- frankpf 7y agoUsing a cookie is not a benefit, it's a downside. You have to deal with CSRFs, which aren't possible with localStorage.