Quantcast
Channel: Question and Answer » json
Viewing all articles
Browse latest Browse all 148

Is there a benefit of using stateless JWT over SHA256 hash for API tokens?

$
0
0

Does it make sense to use stateless JWT (without persistent storage) over plain SHA256?

Example scenario:

  1. User logs in

  2. User token generated as follows:
    a. JWT.encode(userId, ‘secret’)
    or
    b. SHA256(userId + ‘secret’)

  3. Client app sends request with userId and token

  4. Request is verified via:
    a. JWT.decode(token, ‘secret’), then checking that resulting JWT.userId compared to request userId
    or
    b. SHA256(userId + ‘secret’), then checking that resulting hash compared to request token

JWT allows token expiration, however beyond that I don’t see any benefit?


Viewing all articles
Browse latest Browse all 148

Trending Articles