4 ms·
Think you misread, they were asking about the difference between a session ID in a cookie, and a bearer token. Not a session ID and a JWT. With a bearer token
by BigJono 4y ago
Think you misread, they were asking about the difference between a session ID in a cookie, and a bearer token. Not a session ID and a JWT.
With a bearer token each microservice still needs to call out to an auth service to validate the token, right?
- slowmovintarget 4y agoFunny thing about the terminology, JWT is just one kind of bearer token. The phrase bearer token in the first place simply means that if you have the token, assume you are who you say you are. (It's also shorthand for passing in the authorization HTTP request header with type "Bearer: ") If you have an opaque token, then yes, you save nothing and still require a call to a central service.
- sieabah 4y agoIf you share the hmac key or do private/public key signing you're able to distribute the public signing keys to your infra. In doing so you just validate the token against the public key. You can then rotate these keys and have a list of them to validate against and age off keys which would be the last tokens expiration +1 day.
- treis 4y agoOne bearer token can map to several session IDs.
- foomatic2u 4y agoOr one bearer token can have one session Id. Depends on how you implement.