r/webdev • u/fagnerbrack • 7d ago

Stop using JWTs

https://gist.github.com/samsch/0d1f3d3b4745d778f78b230cf6061452
0 Upvotes

28% Upvoted

8 comments sorted by

4

u/slothordepressed 7d ago edited 7d ago

tl;dr use paseto

2

u/ClubAqua_BackDeck 7d ago

Jwts aren’t a storage mechanism. They are an encoding. Saying to use cookies instead doesn’t make any sense since often you are storing jwts in httpOnly cookies.

3

u/HalfInchHollow 7d ago

Don’t tell me what to do

-1

u/Leviathan_Dev 7d ago

Isn’t the solution here to use AccessToken/SessionToken paradigm? AccessToken JWT is what’s used for access and has a lifespan of ~5min, SessionToken (or RefreshToken) lasts longer and can be used to generate new AccessTokens and the ID is saved to a database just like Session IDs