search

auth0-blog / angular2-authentication-sample

This is a sample that shows how to add authentication to an Angular 2 (ng2) app
MIT License
966 stars 334 forks source link

jwt signing without password #59

Closed rakeen closed 8 years ago

rakeen commented 8 years ago

While signing a token with jsonwebtoken you guys omitted the password. Is there any specific reason to do so(i.e security concern)?

chenkie commented 8 years ago

The user's password shouldn't be a part of the JWT payload and generally you just need some identifier for the user. If passwords are properly stored (hashed) then they wouldn't be useful as part of the payload anyway :)