✳flâneur — a map of the web's best reading

JWT should not be your default for sessions

evertpot.com · 1,708 words · saved by 1 readers

When designing web applications, (especially the traditional HTML kind), you will at one point have to figure out how to log a user in and keep them logged in between requests. The core mechanism we use for this are cookies. Cookies are small strings sent by a server to a client. After a client receives this string, it will repeat this in subsequent requests. We could store a ‘user id’ in a cookie, and for any future requests we’ll know what user_id the client was. But this is very insecure. The information lives in the browser, which means users can change USER_ID and be identified as a different user. The traditional way to solve this is what’s known as a ‘session’. I don’t know what the earliest usage of sessions is, but it’s in every web framework, and has been since web frameworks are a thing. Often, sessions and cookies are described as 2 different things, but they’re really not. A session needs a cookie to work. Instead of a predictable user id, we’re sending the client a comple

May 10, 2021 JWT should not be your default for sessions Cookies When designing web applications, (especially the traditional HTML kind), you will at one point have to figure out how to log a user in and keep them logged in between requests. The core mechanism we use for this are cookies. Cookies are small strings sent by a server to a client. After a client receives this string, it will repeat this in subsequent requests. We could store a ‘user id’ in a cookie, and for any future requests we’ll know what user_id the client was. Cookie: USER_ID=123 But this is very insecure. The information li

Explore this link on the map →

saved by

related reading