Hot answers tagged


oAuth with JWT is usually stateless for the resource servers, which just validates the JWT signature and metadata. The JWT is time limited - signalled through the exp (expiration) attribute. When the token expires, and the user is still active, the client is obliged to fetch a new JWT from the authorization server (AS). It will then usually identify the ...

Only top voted, non community-wiki answers of a minimum length are eligible