3 ms·
The tokens are "generated" on the client, and the server just gives the client enough information to make that locally generated token become "valid", without b
by ajayyy 2y ago
The tokens are "generated" on the client, and the server just gives the client enough information to make that locally generated token become "valid", without being able to link that token to a specific validation attempt
- sebazzz 2y agoSo basically the server signs the token and afterwards the server can verify its own signature for every request with that token?
- faeranne 2y agolooking at it from a high level, it doesn't appear the final token ever leaves the client till it's being redeemed. There's a middle step that does get signed, but this part is not what is sent.