2 Comments
User's avatar
⭠ Return to thread
Neo Kim's avatar

nice to see you here, Uriel.

- default to HTTPS

- server validates the JWT signature each time, so it's difficult to spoof

- encrypt JWT (https://www.rfc-editor.org/rfc/rfc7516)

- some best practices: https://newsletter.systemdesign.one/i/162682441/jwt-security

Expand full comment
Uriel Bitton's avatar

Thanks Neo!

I'll take a look :)

Expand full comment