0

Reading around I gather that for a Restful API since you don't use cookies,then you send the token in the Auth header.Correct so far?

When on a traditional MVC app ,do you send the token inside a httponly cookie? Does then the server have to parse the cookie in order to extract the token?

If that's the deal then why use jwt at all and not just go for a session cookie, since for example a shopping cart application would need to keep a session anyway?

3
  • 1
    It looks like your question is, "why use JWT when you could easily use sessions?" Maybe this: stackoverflow.com/questions/43452896 would answer it. – borcho Apr 7 at 15:45
  • "REST" is an ooold term that someone decided to dig up to sell things, methinks. "MVC" is an architecture... however, Microsoft started using it as a sort of brand name for a framework. To be strictly "Restful" you cannot have a user state. No tokens, no cookies, no logins... I think what they're trying to say is "don't use server-side session variables" and there's many ways to avoid using those and still pass a state. – pcalkins Apr 7 at 22:01
  • 1
    @pcalkins cookies are often used with stateless REST APIs because they are the most secure place to store credentials (whether a JWT or a session ID). In this sense the cookie isn't maintaining state for the client: it is merely a convenient way to store and transmit credentials. – Conor Mancone Apr 7 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.