3 ms·
A JWT still needs to be verified by the backend, it just doesn't need to do a database lookup to do so. But if you're statefully storing sessions anyway...
by fastball 6y ago
A JWT still needs to be verified by the backend, it just doesn't need to do a database lookup to do so.
But if you're statefully storing sessions anyway...
- ridethebike 6y agoOf course, trusting JWT without verifying it first would be madness