6 ms·

What's the difference between an opaque token and a cookie that has a single session identifier in it? 'y know - the way we did it in the 90's.

• ffo 4y ago
  The cookies is mainly used to identity the user (e.g. his session and prior authentication), while the tokens are used to forward something to proof that the an application wants to access one or multiple apis.
  • tgv 4y ago
    So if you need the client to pass on sensitive (authentication/authorization) information to another party without that party having access to the original provider of that data (except its public key, I suppose). Then JWT is a usable format, with a lot of support.
    • ffo 4y ago
      Well, yes ;-)
• cnorthwood 4y ago
  There isn't one - the session identifier is an example of an opaque token
• senko 4y ago
  Cookie is a mechanism to store and send tokens to the server, which is orthogonal to what the token is. You could store JWT in a cookie, or use opaque token in a HTTP header, for example. That said, the session cookies we loved back in the day were usually opaque tokens, yeah.
• mooreds 4y ago
  For a normal web app, not too much. As sibling comments point out, an opaque token can be stored elsewhere (though, to be fair, the session identifier which is in that cookie can be placed elsewhere too). Cookies are limited in where they can be sent (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...).