Stop Using JWTs
This article argues against using JSON Web Tokens (JWTs) for user session management, suggesting that traditional cookie-based sessions are more secure and appropriate. It advises developers to avoid storing authentication credentials in local storage and highlights the complexity of implementing secure stateless authentication.
Why it matters
Security best practices for web authentication are critical for protecting user data, and this piece challenges common industry trends in favor of more robust, established methods.
TLDR: JWTs should not be used for keeping your user logged in. They are not designed for this purpose, they are not secure, and there is a much better tool which is designed for it: regular cookie sessions.
The article provides a technical critique of a common development practice based on security principles.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in