3 ms·
Isn’t that just sessions but with extra steps?
by enkrs 5y ago
Isn’t that just sessions but with extra steps?
- jasfi 5y agoWell the JWT has encrypted info that is verified on each call, so there is extra security.
- chris37879 5y agoyeah, JWT's are a nice standard way of doing that, but it's functionally not really different than the HTTPS + Session + Nonce pattern that's been in use for about 10 years now, and, provided you pick a secure function to make the hash for the nonce, the nonce may be more secure since it rotates with each payload and the JWT's encryption lasts for its lifetime.
- jasfi 5y agoThe JWTs I use expire after a given time and are renewed. I agree, there's not much difference. Its more like a standard way of generating tokens.