Previous answers are rock solid. I'll jump in here to provide a more context and little caveat. There are lots of ways to using JWT; session management is one of them. Although it presents a few drawbacks when dealing with timeouts and advanced requirements like re-authentication. Also, I've seen JWT placed in Cookies. As other's have stated, CSRF ...


PCI DSS doesn't care about your framework, it cares about how you handle credit card details. It spans across your front and backend services. If you're not familiar with PCI-DSS the most cost effective way may be to use a third-party payment provider (e.g. PayPal) rather than implementing your own.

Only top voted, non community-wiki answers of a minimum length are eligible