undefined | Better HN

0 pointsynniv7y ago0 comments

You can sign session ids to prevent DoS, and you can cache session ids to avoid database lookups, but you can't detect forged or stolen JWT tokens.

0 comments

1 comments · 1 top-level

nmgsd7y ago

You can't forge a JWT without stealing the private key of the valid JWT signer.

You can steal a JWT token the same way you can steal a session token.

j / k navigate · click thread line to collapse