4 ms·
Well, it's a drawback because if you're doing the validation anyway, why bother with the added complexity of the JWT in the first place? You've removed the prim
by fknorangesite 4y ago
Well, it's a drawback because if you're doing the validation anyway, why bother with the added complexity of the JWT in the first place? You've removed the primary advantage.
- Salgat 4y agoI'm not sure why JWTs are considered complex. In C# I generate tokens with a couple lines of code. Sure you can get fancy with the claims, but it's not required if you're going to access the DB anyways on authenticated requests.
- fknorangesite 4y agoYou're right, they aren't, particularly. Just moreso than alternatives - especially if > it's not required if you're going to access the DB anyways on authenticated requests. then what's the point? You're just re-inventing bearer tokens.
- Salgat 4y agoI can see one massive advantage is that you could disable the db access/verification for service-to-service communication, since revoking an internal service token is exceptionally rare (and if it occurs, you have much bigger problems to worry about).
- fknorangesite 4y agoWhich is exactly the kind of valid use case already presented in OP.