3 ms·
The only argument they elaborate on is still easily addressed with a validation of the token against a database on every request, and it's hardly a drawback com
by Salgat 4y ago
The only argument they elaborate on is still easily addressed with a validation of the token against a database on every request, and it's hardly a drawback compared to other methods if the other methods do the same thing.
- fknorangesite 4y agoWell, it's a drawback because if you're doing the validation anyway, why bother with the added complexity of the JWT in the first place? You've removed the primary advantage.
- Salgat 4y agoI'm not sure why JWTs are considered complex. In C# I generate tokens with a couple lines of code. Sure you can get fancy with the claims, but it's not required if you're going to access the DB anyways on authenticated requests.
- fknorangesite 4y agoYou're right, they aren't, particularly. Just moreso than alternatives - especially if > it's not required if you're going to access the DB anyways on authenticated requests. then what's the point? You're just re-inventing bearer tokens.
- Salgat 4y agoI can see one massive advantage is that you could disable the db access/verification for service-to-service communication, since revoking an internal service token is exceptionally rare (and if it occurs, you have much bigger problems to worry about).
- fknorangesite 4y agoWhich is exactly the kind of valid use case already presented in OP.