re: Use JSON Web Tokens to Make a Secure Web App VIEW POST

re: Yes, if it's used on production, then we should take steps to secure it like providing expiry date and do hashing. There should be a way to verify ...

Never use jwts as sessions. Even with a expiry, you can not invalidate it on the serversidr, and if you have to keep track in the backend, its not stateless anymore. So theres no reason not to go with cookies or plain old sessions.

The most concerning thing here is the localstorage, i used this myself in several apps, but recently i understood the security issues being introduced and fixed it immediatly. Jwts are good for server2server authentication, when several criterias are met, as you said (for example expiriy date, signing and so on)


Code of Conduct Report abuse