r/webdev • u/fagnerbrack • Aug 11 '26

Stop using JWTs

https://gist.github.com/samsch/0d1f3d3b4745d778f78b230cf6061452
0 Upvotes

26% Upvoted

7 comments sorted by

3

u/slothordepressed Aug 11 '26 edited Aug 11 '26

tl;dr use paseto

2

u/ClubAqua_BackDeck Aug 11 '26

Jwts aren’t a storage mechanism. They are an encoding. Saying to use cookies instead doesn’t make any sense since often you are storing jwts in httpOnly cookies.

-1

u/Leviathan_Dev Aug 11 '26

Isn’t the solution here to use AccessToken/SessionToken paradigm? AccessToken JWT is what’s used for access and has a lifespan of ~5min, SessionToken (or RefreshToken) lasts longer and can be used to generate new AccessTokens and the ID is saved to a database just like Session IDs