3 ms·
Seems like a lot of work where a simple session id would suffice. JWT’s are not the appropriate solution where session-like behavior is wanted.
by bouke 7y ago
Seems like a lot of work where a simple session id would suffice. JWT’s are not the appropriate solution where session-like behavior is wanted.
- rp2684 7y agoThis problem will also exist if an opaque token is used instead of a JWT (as long as a refresh token is being used). Now you may argue that we don't need to use refresh tokens because that's complex, however, in that case, you are severely compromising on user security. See this please: https://supertokens.io/blog/all-you-need-to-know-about-user-session-security?s=y https://supertokens.io/blog/all-you-need-to-know-about-user-...