4 ms·
The question is why you couldn't just have "${prefix}-${JWT}" as your format. Then you can just strip the prefix before parsing. Which means don't need to worr
by threeseed 6y ago
The question is why you couldn't just have "${prefix}-${JWT}" as your format.
Then you can just strip the prefix before parsing. Which means don't need to worry about checksumming or entropy and you have the ability to embed large amounts of data as well as plenty of client support and libraries.
Would be curious if this implementation is somehow more performant.
- benatkin 6y agoYeah, what GitHub is doing by including the checksum is reinventing JWT, with HS256 precisely. They could also make it easy to grep (see other comment) by having the payload always start with the same prefix - if it starts with `{"gh":"` the jwt will contain `.eyJnaCI6I` The subject doesn't need to be a user ID, and it sounds like they don't want that. It could be a session ID.