Comment on: JWT is a scam and your app doesn't need it
Who uses JWT like this anyway?Typical production architecture would look like
- frontend only ever sees an opaque session cookie
- bff stores the access token against session and attaches it when calling backend servicesYes, storing JWTs directly in the frontend client is a bad idea but surely there is a better way of communicating that than "JWT is a scam and your app doesn't need it".> RS256 verification is in the same order of magnitude as a Redis lookupBut the point is that the verification is CPU bound and local to the service - which means that it is horizontally scalable.