DEV Community

Discussion on: Use JSON Web Tokens to Make a Secure Web App

aumayeung profile image
John Au-Yeung Author

Yes, if it's used on production, then we should take steps to secure it like providing expiry date and do hashing. There should be a way to verify that a token is autnetic on server side.

Also, we shouldn't store sensitive data with JWTs.

See for more info.

nhh profile image

Never use jwts as sessions. Even with a expiry, you can not invalidate it on the serversidr, and if you have to keep track in the backend, its not stateless anymore. So theres no reason not to go with cookies or plain old sessions.

The most concerning thing here is the localstorage, i used this myself in several apps, but recently i understood the security issues being introduced and fixed it immediatly. Jwts are good for server2server authentication, when several criterias are met, as you said (for example expiriy date, signing and so on)