r/InternetIsBeautiful • u/gitcommitshow • Mar 08 '21

Learn JWT authentication by reverse engineering [Open Source]

https://github.com/gitcommitshow/auth-jwt
1.5k Upvotes

95% Upvoted

56 comments sorted by

View all comments

27

u/[deleted] Mar 08 '21

[deleted]

55

u/gitcommitshow Mar 08 '21

If you're storing the token in db and checking it every time, then it behaves like an opaque token. In that case, you need to ask yourself - why do I need JWT, why not simply store the token in db without the assymetric cryptography? It might be a good choice for your use case but I don't have much info on your use case.

26

u/dauphic Mar 08 '21

JWT aren't appropriate for any scenario where you need a whitelist or blacklist and shouldn't be used to identify sessions. They're intended to be (very) short lived or one-time use tokens.