New answers tagged


Really the question should be How can I be certain a signed in user is the same person who signed in so I can send them a JWT? And the answer to that is you can't. This is because of the security best practices: Assume all input from users is fake or an attack until proven otherwise. This means you need to require them to re-authenticate to ...

Top 50 recent answers are included