3 ms·
No one should be using JWT but it's unfair to blame JWT here. Apple wasn't verifying the supplied email address belonged to the signed in user - that's complete
by arkadiyt 6y ago
No one should be using JWT but it's unfair to blame JWT here. Apple wasn't verifying the supplied email address belonged to the signed in user - that's completely outside of the token format they chose.
- switz 6y ago> No one should be using JWT I've heard criticisms of JWT -- mostly around the lack of ability to revoke a JWT. One could then introduce a refresh token with a longer ttl, which can be revoked on the server. But of course then you lose some of the statelessness that JWT benefits from. But still, it seems like a reasonable approach to authentication to me. I can authenticate with several services if need be, and I can check locally if my token is 'likely' valid. Care to expand why you think one shouldn't use JWT tokens?
- nick-garfield 6y ago> No one should be using JWT What??