We changed our privacy policy. Read more.

Hot answers tagged


oAuth with JWT is usually stateless for the resource servers, which just validates the JWT signature and metadata. The JWT is time limited - signalled through the exp (expiration) attribute. When the token expires, and the user is still active, the client is obliged to fetch a new JWT from the authorization server (AS). It will then usually identify the ...

Only top voted, non community-wiki answers of a minimum length are eligible