#authentication

4 pages search “authentication” ↳ all tags

Wiki 4

  • Cookie Session Authentication The default browser-session pattern: opaque random ID in an HttpOnly cookie, server-side store maps it to user state
  • JWT for Sessions (Anti-Pattern) Why using JWTs as session tokens is the wrong tool — lifetime mismatch, false statelessness, spec footguns, and what to use instead
  • PASETO Platform-Agnostic Security Tokens — a tighter alternative to JWT that removes algorithm choice and the JOSE footguns
  • Stop using JWTs (samsch gist) Long-circulating gist arguing JWTs are wrong for sessions; use cookie sessions, and use PASETO for the rare short-lived-token cases