3 ms·
Side note, the idea of JWT without verifying the token against a database, made me doubt what I was doing. I wasted too many cycles trying to understand how it
by dvdhnt 6y ago
Side note, the idea of JWT without verifying the token against a database, made me doubt what I was doing.
I wasted too many cycles trying to understand how it was secure while debating how much latency my database check was introducing on every single request compared to those simply using the JWT as-is.
It has made something I considered "settled" to be a time-sink.
- karatestomp 6y agoThey don't make a ton of sense until your public-facing services get kinda mesh-like. If it's all in one DB, including authorization and authentication data, and you never have one service requesting resources from other services on behalf of a user, they're probably overkill and regular sessions would be fine. (Nb. I've not personally seen them used in a case for which they make sense, yet, but only in smaller projects because they're trendy)