3 ms·
What are the benefits of doing this instead of just requiring authentication with every request? Is it because the authentication part is a lot of work for the
by gizzlon 13y ago
What are the benefits of doing this instead of just requiring authentication with every request?
Is it because the authentication part is a lot of work for the server or client?
Is it for the negligible (in this context) security benefits of not using the same secret-key for all traffic?
- general_failure 13y agoThe hashing for the authentication is intentionally computationally slow (thus mitigating brute force validation). The token issued is basically like a session id - validating a session id is really just like string compare, so it's much much fast.