2 ms·
Aren't these tokens used in addition to cookies? That's how I've always implemented them (not using Rails). Basically a separate token which must be presented
by jmathai 12y ago
Aren't these tokens used in addition to cookies?
That's how I've always implemented them (not using Rails). Basically a separate token which must be presented with cookies to perform certain actions. If the cookie identifies a valid session but the token does not pass verification you assume it's a forged request.
- bigtunacan 12y agoWhile you could use them in such a manner I believe it is more common to use tokens as a replacement for cookies. Typically this is used when you are interacting with a pure Web API/Web Service. Mobile apps, centralized web services, Angular and crew, etc...