14 ms·
Right, but rm -fr / is also easy to write, but is pretty bad code. JWTs and statelessness have their uses, building in refreshing is not that difficult (if it's
by kreetx 4y ago
Right, but rm -fr / is also easy to write, but is pretty bad code. JWTs and statelessness have their uses, building in refreshing is not that difficult (if it's not built in already), and using "none" well, just don't use that.
- marcosdumay 4y agoThere are alternatives that won't accept "none" or broken encryption algorithms, and that won't allow you to access the token data without verifying its authenticity. JWT is just a bad standard all around.
- 0x457 4y agoMany issues of JWT are actually issues on library for nodejs to work with JWTs and partially the language: trick server to use public key as secret to validate JWT, trick server to use none. JWT itself is also poor by having things like "none" at all. Which means in every valid place to use JWT, you should really be using PASETO.