medium10 pts · first answer countsjwtauthentication
Sensitive data inside a JWT
A developer puts the user’s national ID number and internal fraud score in the JWT payload, saying "it’s signed, so it’s safe". What is the problem?
Discussion 0
Join free to post in the discussion.
Related questions
- Storing user passwordsFull Stack Developer
- JWT in localStorageFull Stack Developer
- CSRF with cookie sessionsFull Stack Developer
- Refresh token rotationFull Stack Developer
- JWT algorithm confusionFull Stack Developer
- Redirect check that can be bypassedFull Stack Developer
- Designing password reset linksFull Stack Developer
- OAuth for a browser-only appFull Stack Developer