0

Reading around I gather that for a Restful API since you don't use cookies,then you send the token in the Auth header.Correct so far?

When on a traditional MVC app ,do you send the token inside a httponly cookie? Does then the server have to parse the cookie in order to extract the token?

If that's the deal then why use jwt at all and not just go for a session cookie, since for example a shopping cart application would need to keep a session anyway?

Improve this question
3
  • 1
    It looks like your question is, "why use JWT when you could easily use sessions?" Maybe this: stackoverflow.com/questions/43452896 would answer it.
    – borcho
    Apr 7, 2021 at 15:45
  • "REST" is an ooold term that someone decided to dig up to sell things, methinks. "MVC" is an architecture... however, Microsoft started using it as a sort of brand name for a framework. To be strictly "Restful" you cannot have a user state. No tokens, no cookies, no logins... I think what they're trying to say is "don't use server-side session variables" and there's many ways to avoid using those and still pass a state.
    – pcalkins
    Apr 7, 2021 at 22:01
  • 1
    @pcalkins cookies are often used with stateless REST APIs because they are the most secure place to store credentials (whether a JWT or a session ID). In this sense the cookie isn't maintaining state for the client: it is merely a convenient way to store and transmit credentials.
    – Conor Mancone
    Apr 7, 2021 at 22:08

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .