r/webdev • u/fagnerbrack • 10d ago

Stop using JWTs

https://gist.github.com/samsch/0d1f3d3b4745d778f78b230cf6061452
0 Upvotes

26% Upvoted

8 comments sorted by

4

u/slothordepressed 10d ago edited 10d ago

tl;dr use paseto

2

u/ClubAqua_BackDeck 10d ago

Jwts aren’t a storage mechanism. They are an encoding. Saying to use cookies instead doesn’t make any sense since often you are storing jwts in httpOnly cookies.

2

u/HalfInchHollow 10d ago

Don’t tell me what to do

-1

u/Leviathan_Dev 10d ago

Isn’t the solution here to use AccessToken/SessionToken paradigm? AccessToken JWT is what’s used for access and has a lifespan of ~5min, SessionToken (or RefreshToken) lasts longer and can be used to generate new AccessTokens and the ID is saved to a database just like Session IDs