Viewing profile — anon1252

> JWTs are a silver bullet, but it's nicer than rolling your own signing scheme. you can use HMAC to sign session cookies as well, the issue isn't about signing.

> Traversing a list of 100,000 users/sessions in a db to pull up the session is a different beast compared to traversing an in memory list of 10-100 revoked JTIs in redis. It is a …

> Ok, yes, session is a concept. Session state can be stored in its entirety or split between an ID and body. the storage of session has absolutely nothing to do with the session. …

Yes it does mean something. a session is something that is identified by an ID on the client and is persisted on the server with the corresponding ID. It's a concept. It doesn't ha…

> Cookies are special headers added to HTTP requests to store state. The topic is more about session VS JWT, not cookies vs whatever local storage is used in place of cookies.

> and expiring it when you log-out? and how would you do that if the user doesn't actively log out of a service?

The idea of JWT is basically you give your user a "token" that can be used against many "services" while servers don't have to persist the state of that token, just be able to read…

I would absolutely subscribe to a email service with a 5/10/15 dollars one time payment.

> Shouldn't employees have the right to collectively strike to get better conditions at work? There's a lot more at stake here than "drama for the company". Doesn't the employer ha…

> there's no real process in place for situations of misconduct in the office. There shouldn't be a "process" set by Google when it comes to sexual harassment, employees should be …

> What would make you think there's a lack of outrage related to the US and Iraq + Afghanistan? Where is the outrage right now? where is the outrage over the slaughter of children …

> There are 40 enemy combatants held at Guantanamo. They have public legal representation and visitation rights. They are being held there without a trial. They have not been tried…