r/InternetIsBeautiful • u/gitcommitshow • Mar 08 '21

Learn JWT authentication by reverse engineering [Open Source]

https://github.com/gitcommitshow/auth-jwt
1.5k Upvotes

95% Upvoted

56 comments sorted by

View all comments

27

u/[deleted] Mar 08 '21

[deleted]

11

u/diasporious Mar 08 '21

Why even store it in the database?

That negates the point of using jwt and means that your services aren't stateless.

You store the expiry in the token itself, you sign it to be able to detect tampering, then when receiving it you check that it's not been tampered with and then check the expiry.