3 ms·
I thought the latest recommendation was to use JWTs with a 15 minute expiration. You could also put a JWT in a cookie. Also some implementations of a Session do
by jabart 2y ago
I thought the latest recommendation was to use JWTs with a 15 minute expiration. You could also put a JWT in a cookie. Also some implementations of a Session don't use a database lookup and need extra work to invalidate a session. Same lookup can be used on a JWT.
- pcthrowaway 2y agoYeah but then you give them a refresh token which you still have the same problem with. > You could also put a JWT in a cookie. Yep, I mentioned that also