3 ms·
> Well you want to check your session cookies as well against something ;-) I think that is the point of the op: If you have to check a db to realize revocatio
by ketzu 4y ago
> Well you want to check your session cookies as well against something ;-)
I think that is the point of the op: If you have to check a db to realize revocation, then you can use session cookies because they also need to hit the db. (Because you don't get rid of the db hit for using jwt).
- marcosdumay 4y agoWell, that certainly depends. One accesses the db on every request, the other accesses the db on every correct request (and the db is smaller). As a rule, there is no difference. But if you are one of the exceptions, those can have differences of orders of magnitude.