Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I agree with you (I do the same).

However, in certain cases it's useful to have stateless sessions (or rather, moving the state to the client, using signed and/or encrypted tokens).

In this case, JWT is used by e.g. OpenID-Connect, to pass data between systems. In some of these use-cases the client is an intermediary, passing along the token.



Like a portable passport rather than a centralised authentication model. That does sound an interesting concept :)


Passports (travel documents) are increasingly moving to central authentication too. They were prone to trivial forgery before they were chipped and barcoded. And exactly for the same reason.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: