Comment

Comment by drinchev

As explained in the article, if that's the case then you can't really trust the JWT anymore only for it's cryptographic signature and you rely on an internal store entry that makes the token valid / invalid.

This makes no benefits as to bearer token or any random string that the server "knows" is a valid authenticated request via internal store, like a DB.

parent drinchev 4 years ago

No comments yet

Be the first to share your thoughts.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton