7 ms·
What do you mean "outside the context the tokens were handed out in"? And isn't this the same as stealing a cookie or something?
by erhaetherth 3y ago
What do you mean "outside the context the tokens were handed out in"?
And isn't this the same as stealing a cookie or something?
- AtNightWeCode 3y agoIt is the same problem. My main issue with how it works is that typically tokens (and cookies) are valid until they expires. You browse some service and then it can be used by anybody for hours after that. And the methods for securing JWTs are either more tokens with shorter expiration time, using sessions or token black lists. Which kinda kills the beauty about having signed tokens.