4 ms·
That only describes why you shouldn't use them for sessions, not why you should not use them at all.
by pat2man 7y ago
That only describes why you shouldn't use them for sessions, not why you should not use them at all.
- thinkloop 7y agoWhat is there besides sessions?
- grenoire 7y agoAPI access?
- joepie91_ 7y agoFor API access, there's no point using JWTs either. In the vast majority of cases, a randomly-generated API key is sufficient and JWT would be unnecessary complexity (you're using TLS, right...?) and in the odd high-security usecase where the key still must not ever be sent to the server, you can use eg. client certificates. And if for some reason you have a weird freak edgecase where you really do need a cryptographically signed stateless token... JWT is unsafe[1] and you want PASETO[2] instead. [1] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba... [2] https://paseto.io/ https://paseto.io/ Edit: To be clear, with "API" I'm assuming you mean "third-party API", in the original sense of the word. If you just mean "a bunch of endpoints for my SPA", then you should use none of these things, and just use sessions. It's not really an "API" in the "API key" sense.
- staticassertion 7y agoThe article addresses the singular valid use case at the bottom.