4 ms·
> Also, a JWT only leaks sensitive data if you purposely want the JWT to ship sensitive data. Nothing forces you to do that. TFA says a JWT _may_ expose sensit
by jsiepkes 2y ago
> Also, a JWT only leaks sensitive data if you purposely want the JWT to ship sensitive data. Nothing forces you to do that.
TFA says a JWT _may_ expose sensitive data. Which is, as you yourself confirm, true.
- motorest 2y ago> TFA says a JWT _may_ expose sensitive data. Which is, as you yourself confirm, true. Not really. The complain about JWTs leaking sensitive data reads like the bike fall meme. It's like complaining that REST APIs expose sensitive data if not encrypted. Well, that's not a REST trait or something caused by REST, is it? It's you who somehow decided to leak sensitive data through an interface. That's hardly the technology's fault.
- efilife 2y agoby that logic cookies could leak sensitive data too