5 ms·
Well you want to check your session cookies as well against something ;-) Surely you could trust a signature and lifetime but that makes the cookie no differen
by ffo 4y ago
Well you want to check your session cookies as well against something ;-)
Surely you could trust a signature and lifetime but that makes the cookie no different than a JWT (only storage wise the differ in that case).
Generally speaking it is recommended to use opaque tokens and rely on the userinfo / introspect endpoint call to make for the session management.
Only in specific cases where latency and/or scaling might become an issue you should opt for JWT. At least this is my opinion.
- ketzu 4y ago> Well you want to check your session cookies as well against something ;-) I think that is the point of the op: If you have to check a db to realize revocation, then you can use session cookies because they also need to hit the db. (Because you don't get rid of the db hit for using jwt).
- marcosdumay 4y agoWell, that certainly depends. One accesses the db on every request, the other accesses the db on every correct request (and the db is smaller). As a rule, there is no difference. But if you are one of the exceptions, those can have differences of orders of magnitude.