New answers tagged

0

JWTs can be expired. (They should be on a regular basis, or based on certain user actions). Then a new JWT can be issued. But ultimately, if the JWT is stolen and not yet expired, you've been compromised. At the end of the day, if you're going to maintain state, the client needs to hold on to something, session cookie, jwt, whatever... I would recommend you ...


0

@RaptisDimos gave a good answer but I think I will expend on point #3. Why is OAuth2 implicit flow insecure for authentication while still secure for authorization? The problem with the implicit flow when you try to use it for authentication is that the client directly receive an access token and that access token is not bound to any specific ...


6

1.What is the difference between authentication and authorization? Authentication is the process, by which a server checks if a user is indeed the user that it claims to be. This is usually done, when the user gives the username and a password, while the server checks these credentials (username, password) with those stored in its database, when the first ...



Top 50 recent answers are included