search

pauldijou / jwt-client

Micro service to read, write and save JWT headers
Apache License 2.0
35 stars 4 forks source link

Write and read methods #5

Closed simon-p-r closed 8 years ago

simon-p-r commented 8 years ago

Hello

The write and read methods don't appear to be secure as they don't sign or verify the jwt with either a secret string or private / public pem key. What is the purpose of this module?

pauldijou commented 8 years ago

There is another method to verify the token. But security is a server-side problem, this module is mostly there to store the token client-side and help you send it back. Your user will be able to freely change it anyway, whatever lib you are using.