OWASP Top 10 (opens in a new tab)
The official reference for the tools used in this lesson.
Link
Sessions versus JWTs
Server sessions are revocable; JWTs are stateless and awkward to revoke. Pick based on whether you need to log someone out immediately.
Lesson 3.18m 12sIntermediate9.2k students
Lesson length
8:12What this lesson covers
- Compare revocability and statelessness honestly
- Store tokens in cookies with the right flags
- Design refresh and logout before you ship
This lesson sits in Authentication Done Right, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.
In this lesson you will
- Compare revocability and statelessness honestly
- Store tokens in cookies with the right flags
- Design refresh and logout before you ship
Resources
Personal notes are coming soon.