search

dgrijalva / jwt-go

ARCHIVE - Golang implementation of JSON Web Tokens (JWT). This project is now maintained at:
https://github.com/golang-jwt/jwt
MIT License
10.78k stars 994 forks source link

The verification of the token's legitimate signature should precede the content #486

Closed evildao closed 2 years ago

evildao commented 2 years ago

The verification of the token's legitimate signature should precede the content Usually when the token is about to expire, we issue a new token. The previous logic allows an attacker to cheat a legitimate token with a forged token

工具翻译，不知道你能不能看得懂