4 ms·
I agree with you (I do the same). However, in certain cases it's useful to have stateless sessions (or rather, moving the state to the client, using signed and
by sandstrom 12y ago
I agree with you (I do the same).
However, in certain cases it's useful to have stateless sessions (or rather, moving the state to the client, using signed and/or encrypted tokens).
In this case, JWT is used by e.g. OpenID-Connect, to pass data between systems. In some of these use-cases the client is an intermediary, passing along the token.
- laumars 12y agoLike a portable passport rather than a centralised authentication model. That does sound an interesting concept :)
- mahmud 12y agoPassports (travel documents) are increasingly moving to central authentication too. They were prone to trivial forgery before they were chipped and barcoded. And exactly for the same reason.