3 ms·
I've worked on projects that used JWT to maintain session data and it's definitely a horrible idea. Halfway through the project it became very apparent that we
by mmazing 5y ago
I've worked on projects that used JWT to maintain session data and it's definitely a horrible idea. Halfway through the project it became very apparent that we were reinventing the wheel - having to solve problems that were never an issue with maintaining session data server side.
However, I currently use JWT for short term authorization tokens (5 minute expiration) between a web api and a websocket service. The service needs to be lightweight and not rely on database hits to confirm authorization.
But yeah, JWT gets misused VERY often.
- SV_BubbleTime 5y agoAs I understand it, it’s when people put the kitchen sink I to claims. Is that a fair single sentence description? Aside, the idea you can set the entire JWT to “no security” from a signed packet and have a chance at a server accepting it, is crazy.
- mmazing 5y agoIn our case we only pass a user id (which is public information anyway) and encrypt the token on top of that. I think the encryption isn't necessary but hey why not.
- IggleSniggle 5y agoI just want to point out that the article mentions the session issue upfront only to get it out of the way, and follows the session issue with its own set of interesting complaints.