Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Here is the use case that lead to the first implementation of JWT I was ever part of.

You have a single page webapp that uses two APIs for part of the application. For security reasons the APIs are zoned in such a way that neither of them can communicate with each other. The machine of the user sits in a zone where it can send HTTP requests to the zones of either API.

Now design a way to manage sessions across both APIs...

There are certainly a number of ways to accomplish this, but JWT was the cleanest and most performant.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: