2 ms·
That's reasonable. I see so many cases where someone asks "what should I use for auth" and immediately the answer given is JWT, where simple random tokens or s
by senko 5y ago
That's reasonable.
I see so many cases where someone asks "what should I use for auth" and immediately the answer given is JWT, where simple random tokens or session auth would be just fine. And simpler to implement, since they're supported out-of-the box in many frameworks.
- robotdan 5y agoThis is a good point. Keeping it simple is always a good engineering choice. I think one of the reasons JWTs come up so often is that if you are going to use OAuth2/OpenID Connect - ideally the Authorization Code grant, then tokens become an important component. And many IdPs implement the OAuth2 access token as a JWT. So it may be that your IdP ends up making this choice for you. Then you have to learn how to deal with JWTs.