3 ms·

Never trust the client, ever.

• remram 5y ago
  If that's how you feel, don't trust them to logout when they walk away. Make those sessions short-lived and ask for the password again whenever they do something remotely sensitive.
  • SigmundA 5y ago
    If you trust the client then why sign the JWT?
    • remram 5y ago
      The opposite of "never trust the client" is not "always trust the client". Build yourself a model and find out where trust and security are required.