4 ms·
>For JWTs, I agree with this stance, since they are security credentials and therefore basically all of them are sensitive information. As long as it's prod en
by tester34 6y ago
>For JWTs, I agree with this stance, since they are security credentials and therefore basically all of them are sensitive information.
As long as it's prod env and your expiration time is somewhat reasonable, then I don't think it is sensitive at all unless you're storing an actual sensitive informations in them.
- gruez 6y agoSo you're just hoping that there isn't a bad guy on the other side trying to use the credentials in real time? Seems like a bad assumption to make, especially for a site that's specifically made for pasting in JWTs.
- recursive 6y agoNo. No one's hoping anything. It's more like a realization that even if there's a bad guy, they're only going to be able to pwn your dev environment, which has no valuable data in it, and can be replaced with a script.
- deleted 6y ago[deleted]