ParentFull threadvmasto·It's not. If you think it is you probably store JWT unsafely instead of in an httpOnly secure cookie.View on HN