3 ms·
> I assume you mean JWT Yes. > JWT/cookie page rendered stuff is fine Please could you elaborate on this? > And use HTTPS for all traffic. Yes, that is don
by m33k44 6y ago
> I assume you mean JWT
Yes.
> JWT/cookie page rendered stuff is fine
Please could you elaborate on this?
> And use HTTPS for all traffic.
Yes, that is done.
> unless this is a comp-sci quiz question testing your understanding of sessions/security, haha
No it is not :)
- matt_s 6y agoWhat I meant was don't put identifiable user information (ids, email addresses, etc.) on the client in a JWT or cookie and use that as a session identifier. If the JWT or cookie gets hacked then someone can impersonate anyone on your system. Putting their info (email, name, etc.) on a user profile type of page should be fine if your app has a need to do that.
- m33k44 6y agoI am just storing ephemeral id and username in JWT and put the encrypted id in a separate cookie.