3 ms·
I'm not sure why JWTs are considered complex. In C# I generate tokens with a couple lines of code. Sure you can get fancy with the claims, but it's not required
by Salgat 4y ago
I'm not sure why JWTs are considered complex. In C# I generate tokens with a couple lines of code. Sure you can get fancy with the claims, but it's not required if you're going to access the DB anyways on authenticated requests.
- fknorangesite 4y agoYou're right, they aren't, particularly. Just moreso than alternatives - especially if > it's not required if you're going to access the DB anyways on authenticated requests. then what's the point? You're just re-inventing bearer tokens.
- Salgat 4y agoI can see one massive advantage is that you could disable the db access/verification for service-to-service communication, since revoking an internal service token is exceptionally rare (and if it occurs, you have much bigger problems to worry about).
- fknorangesite 4y agoWhich is exactly the kind of valid use case already presented in OP.