3 ms·
But why bother with the extra call to request an access token? Makes everything harder for modest security gains.
by pbreit 5y ago
But why bother with the extra call to request an access token? Makes everything harder for modest security gains.
- loginatnine 5y agoAccess tokens are short lived and can easily be revoked (when opaque). Sending your service credentials to every service is arguably less secure since they can have lesser security or log unwanted things.
- pbreit 5y agoRevocation is actually a major problem with JWTs.