Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If you need to validate the Authorization header on every request that's not really different than using session tokens we've been using for the past 15 years. JWT is just a formalized way of managing cookies. Which is nice and I like it, but it doesn't actually enable anything that couldn't be done before albeit with a more ad hoc approach.


Right, Signed Cookies.

JWT doesn't make the claim that it's a new concept, you are assuming as much. It's a standard and as you correctly gleaned and like most other standards, comes with a lot of benefits, best practices, is battle tested and ready-to-use in your favorite frameworks.

It becomes even more useful if you application serves multiple clients such as browsers, iOS applications and so forth because you can hit the ground running without having to reinvent anything.


Both browsers and mobile frameworks can deal with session cookies just fine. JWT doesn't solve anything there.


Your IOS application can use sessions and cookies. There is nothing magic about sessions and cookies.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: