Every article tagged JWT, in one place.
Showing 4 articles
After a user signs in, every later request must prove who they are. The two common approaches are server-side sessions and self-contained tokens (JWTs). Server-side sessions Browser cookie: sid=7f3b2c1e... (random, meaningless on its own) Server store: sess:7f...
Short-lived access tokens limit damage if one leaks, but users don't want to sign in every 15 minutes. Refresh tokens bridge the gap, and rotation keeps them safe. The idea Sign-in returns a short-lived access token (for example 15 minutes) and a refresh token...
This guide adds a /auth/token login endpoint that returns a JWT, and a dependency that protects routes. It follows the pattern FastAPI's own docs use. Install pip install pyjwt "pwdlib[argon2]" Hashing and tokens # security.py from datetime import datetime, ti...
JWTs are easy to issue and easy to get wrong. Most JWT vulnerabilities come from how tokens are verified, not from the format itself. 1. Always verify, and pin the algorithm import jwt from 'jsonwebtoken'; // Wrong: decode() does NOT check the signature const...
