Closed cch5ng closed 5 years ago
unclear about security issues with relying solely on the jwt for auth; ie case where user starts new browser session without login but with jwt
resc
https://tools.ietf.org/id/draft-ietf-oauth-jwt-bcp-02.html
https://stormpath.com/blog/build-secure-user-interfaces-using-jwts
https://logrocket.com/blog/jwt-authentication-best-practices/
closing as fixed
[x] think it is probably too easy to spoof the uid and so switch this value to email instead
[x] change FE behavior so that if the email value is not available, redirect to login (this is kind of a hassle but better security for now, until I figure out something better)
example
this one seems to stop the server