CODEWITHSUNDEEP
jwt
HeadwindFly
HeadwindFly

Reputation: 884

Can JWT work with mobile apps and is JWT a session replacement?

Some questions about JWT(json web token):

  1. Can it work with mobile?

In my opinion, it works with mobile, but is it a good solution for authentication? If not, what other solutions can be used for authentication between mobile app and server?

  1. Is it a session's replacement?

In a general way, session will store some sensitive data, it can not do this in jwt(can not store sensitive data in jwt payload, because it is unsafe).

In my opinion, sensitive data can only be stored in other places, like redis. But think it like this, what diffence between of jwt and session? I am very confused now.

Upvotes: 3

Views: 2840

Answers (1)

Paul Wasilewski
Paul Wasilewski

Reputation: 10372

First of all you should not put any sensitive data to your JWT payload. JWT is a Access-token format to securely exchange claim information that is mainly used for authorization and is based on HMAC or a public/private key pair using RSA. JWT is also used for information exchange to securely transmit information.

Can it work with mobile? In my opinion, it works with mobile, but is it a good solution for authentication? If not, what other solutions can be used for authentication between mobile app and server?

You are right. It works with all types of mobile apps (native, html5, hybrid). An alternative would be OAuth. But keep in mind JWT only defines the Access-token that can be used for Authorization.

Is it a session's replacement?

I assume you mean sessionStorage/cookies? Then JWT it's not a replacement.

In a general way, session will store some sensitive data, it can not do this in jwt(can not store sensitive data in jwt payload, because it is unsafe).

Like I already wrote, you can encrypt your payload and exchange sensitive data through JWT.

In my opinion, sensitive data can only be stored in other places, like redis. But think it like this, what diffence between of jwt and session? I am very confused now.

They are two different things. Redis and sessionStorage/cookies are data structures, which are used to store (user/session related) data. JWT is a authentication mechanism.

Upvotes: 4

Related Questions