Hacker News Reader

Parent Full thread

m33k44

> I assume you mean JWT

Yes.

> JWT/cookie page rendered stuff is fine

Please could you elaborate on this?

> And use HTTPS for all traffic.

Yes, that is done.

> unless this is a comp-sci quiz question testing your understanding of sessions/security, haha

No it is not :)

View on HN

What I meant was don't put identifiable user information (ids, email addresses, etc.) on the client in a JWT or cookie and use that as a session identifier. If the JWT or cookie gets hacked then someone can impersonate anyone on your system.

Putting their info (email, name, etc.) on a user profile type of page should be fine if your app has a need to do that.

I am just storing ephemeral id and username in JWT and put the encrypted id in a separate cookie.

Reply on news.ycombinator.com