4 ms·
> If you compare the work and complexity involved in developing and maintaining the two solutions side-to-side, JWT is still much simpler overall for pretty muc
by angoragoats 2y ago
> If you compare the work and complexity involved in developing and maintaining the two solutions side-to-side, JWT is still much simpler overall for pretty much all scenarios.
I still disagree, especially given the prevalence of session based solutions in pretty much every web framework out there.
Your post contains a couple of suggestions that are counter to just about every piece of advice I’ve ever read about JWTs (for example, increasing expiration times to a day). So, consider me thoroughly unconvinced.
And you’re not even considering the solution that some web frameworks (e.g. Rails) ship by default, which is to store the entire session object itself in a cookie, which was purpose built for that sort of thing. Then very little is required on the server.
- jongjong 2y agoIn the rails example you gave, if they go so far as storing the entire session object in a cookie, I don't see why they wouldn't just use JWT as it's basically the same idea with an added signature to prove that it was generated by the server. Why would you invent something new which is just about as complex, has the same disadvantages and has fewer advantages?
- angoragoats 2y agoBecause the mechanism used is is simple and sufficient, and using JWTs would be more complex. Rails encrypts the cookie data so signatures are unnecessary. Also, Rails has been doing this since 2007, three full years before the JWT spec was first published.