I am implementing a webserver and the guideline I am following suggests: - to create token by a Serializer that takes the IdUser, a symmetric key and an expiry date - provide it to the user but not store this token in a database - to check a request with a token by decrypting the token by the same symetric key, check the expiry, then check whether the idUser is valid and then allow the operation.

It does not seem very secure to me - do you confirm that this is a valid & secure practice?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.