8

Previous answers are rock solid. I'll jump in here to provide a more context and little caveat. There are lots of ways to using JWT; session management is one of them. Although it presents a few drawbacks when dealing with timeouts and advanced requirements like re-authentication. Also, I've seen JWT placed in Cookies. As other's have stated, CSRF ...


1

PCI DSS doesn't care about your framework, it cares about how you handle credit card details. It spans across your front and backend services. If you're not familiar with PCI-DSS the most cost effective way may be to use a third-party payment provider (e.g. PayPal) rather than implementing your own.


Only top voted, non community-wiki answers of a minimum length are eligible