4 ms·
What else should we use that is not over-engineered?
by api 7y ago
What else should we use that is not over-engineered?
- rvz 7y agoHonestly, I find that PASETO [0] is a better candidate to replace JWTs since it supports encrypting these tokens and doesn't have multiple ciphers to choose from, unlike JWTs. They can be used just like them for signing, etc just without the weak cryptography in the token. Fernet [1] was close to being an alternative but I've seen that even Branca [2] tokens look much more like a saner alternative for replacing JWTs. [0] - https://paseto.io https://paseto.io [1] - https://github.com/fernet/spec https://github.com/fernet/spec [2] - https://branca.io https://branca.io
- kam 7y agoFor sessions? A random token and a key-value store.
- moltar 7y agoCookies have been battle tested and are very secure. Enable http only mode and you can’t even access them from JS thus eliminate possibility of take over / token theft.