4 ms·
It seems to me that if an attacker gets a JWT they also have the refresh token. No they don’t. JWTs can be used with third party services that should never se
by mikeryan 2y ago
It seems to me that if an attacker gets a JWT they also have the refresh token.
No they don’t. JWTs can be used with third party services that should never see a refresh token. Those are the requests that should be presumed vulnerable.
- redwoolf 2y agoI’ve not come across such a use case as I’ve only ever written applications where we own both the service and the clients. Thanks for the explanation.