4 ms·
What is there besides sessions?
by thinkloop 7y ago
What is there besides sessions?
- grenoire 7y agoAPI access?
- joepie91_ 7y agoFor API access, there's no point using JWTs either. In the vast majority of cases, a randomly-generated API key is sufficient and JWT would be unnecessary complexity (you're using TLS, right...?) and in the odd high-security usecase where the key still must not ever be sent to the server, you can use eg. client certificates. And if for some reason you have a weird freak edgecase where you really do need a cryptographically signed stateless token... JWT is unsafe[1] and you want PASETO[2] instead. [1] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba... [2] https://paseto.io/ https://paseto.io/ Edit: To be clear, with "API" I'm assuming you mean "third-party API", in the original sense of the word. If you just mean "a bunch of endpoints for my SPA", then you should use none of these things, and just use sessions. It's not really an "API" in the "API key" sense.