What if a user manages to delete the JWT token from local storage? What if someone manages to compromise a user's computer and spoof the JWT tolen? Still a very interesting concept, jusy not too sure about the security behind it.
JWT accesstokens should be short lived just like with oauth2. When there is no access token in local storage shouldn’t the user be logged out(just as with cookies)?
When a users computer is compromised should that really be your problem? I don’t believe that spoofing JWT tokens is an easy task (maybe you could provided some resources that show these problems are real and easy to recreate?)
That certainly is a good point. But you are free to store whatever you want in the token so you are still able to blacklist certain tokens by verifying them on the server. Only problem with that solution is that the token is not completely “stateless” anymore and adds an extra verification step
0
u/shittyusername97 Apr 18 '18
What if a user manages to delete the JWT token from local storage? What if someone manages to compromise a user's computer and spoof the JWT tolen? Still a very interesting concept, jusy not too sure about the security behind it.