Hacker News Reader

I agree with you (I do the same).

However, in certain cases it's useful to have stateless sessions (or rather, moving the state to the client, using signed and/or encrypted tokens).

In this case, JWT is used by e.g. OpenID-Connect, to pass data between systems. In some of these use-cases the client is an intermediary, passing along the token.

View on HN

Like a portable passport rather than a centralised authentication model. That does sound an interesting concept :)

Passports (travel documents) are increasingly moving to central authentication too. They were prone to trivial forgery before they were chipped and barcoded. And exactly for the same reason.

Reply on news.ycombinator.com